Splunk Search

How do you manage modified lookup files that ship with an app?

john_dagostino
Path Finder

Let's say an app ships with one or more default CSV lookup tables. You want to add additional data to these lookups so you modify the CSV (manual edit, not through any search function). The next app update will then overwrite the modified CSV file.

What would be the best practice regarding modifying lookup files that ship with an app? Clone the file and then modify that? Move it to a default app and then update the transforms.conf?

0 Karma

p_gurav
Champion

Hi,

The only safer way here is to take backup of lookup before you update application. And after update you can replace that with your lookup.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...