Splunk Search

How do you manage modified lookup files that ship with an app?

john_dagostino
Path Finder

Let's say an app ships with one or more default CSV lookup tables. You want to add additional data to these lookups so you modify the CSV (manual edit, not through any search function). The next app update will then overwrite the modified CSV file.

What would be the best practice regarding modifying lookup files that ship with an app? Clone the file and then modify that? Move it to a default app and then update the transforms.conf?

0 Karma

p_gurav
Champion

Hi,

The only safer way here is to take backup of lookup before you update application. And after update you can replace that with your lookup.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...