How to automatically update a CSV lookup based on a daily CSV file output from a curl script?

[msudhindra]

Hello,

I have a CURL script that generates a CSV file, and I would like to use that CSV file as a lookup for some searches that we run in Splunk.

The CURL script runs once daily and generates the output file.

My question is, how do I get the lookup table to update automatically whenever a new file is placed in the specified location?
If I define a lookup using the Web GUI, would the lookup table be automatically updated whenever the CSV file is updated?

Also, If the lookup file is generated on one node of a 4 node search head cluster, will it automatically be propagated to all the cluster nodes, or does it need to be manually defined on each node?

Thanks and Regards,
Madan Sudhindra

[MuS · Accepted solution]

Hi msudhindra,

The lookup will be updated as soon as you put the new csv in place, also the lookup will be propagated across the Search Head Cluster http://docs.splunk.com/Documentation/Splunk/latest/DistSearch/HowconfigurationworksinSHC#How_configu...

cheers, MuS