Splunk Search

How do you manage modified lookup files that ship with an app?

john_dagostino
Path Finder

Let's say an app ships with one or more default CSV lookup tables. You want to add additional data to these lookups so you modify the CSV (manual edit, not through any search function). The next app update will then overwrite the modified CSV file.

What would be the best practice regarding modifying lookup files that ship with an app? Clone the file and then modify that? Move it to a default app and then update the transforms.conf?

0 Karma

p_gurav
Champion

Hi,

The only safer way here is to take backup of lookup before you update application. And after update you can replace that with your lookup.

0 Karma
Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...