Hello,
How to outputlookup csv with permission?
***Note that I am not Splunk admin - I only have access to Splunk GUI***
Please help. Thank you so much
For example:
| outputlookup test.csv
It will create test.csv in the following directory with no owner and sharing:Global
I am able to delete it, but I could not modify the permission.
How to outputlookup csv and set to sharing:App and I am the owner?
/opt/splunk/etc/apps/testapp/lookups/test.csv
Owner: No owner App: testapp Sharing: Global Status Enabled
When you said you did this
I added a new lookup by uploading the CSV file by going to Lookups » Lookup table files » Add new
the CSV file was uploaded to this this directory and I can change the permission
When you upload the CSV the list of lookups will show your lookup as private
you can then change the permissions to app, which MOVES the file system location of that file to the location inside the app.
Then when you run outputlookup, you will be updating the one in the app folder, which you have previously set to app permission.
Hello,
I added a new lookup by uploading the CSV file by going to Lookups » Lookup table files » Add new
the CSV file was uploaded to this this directory and I can change the permission
/opt/splunk/etc/users/[myuserID]/testapp/lookups/test.csv
When I used outputlookup, it wrote the same test.csv file into a different directory below and I cannot change the permission.
/opt/splunk/etc/apps/testapp/lookups/test.csv
Please suggest. Thank you
This location means the lookup is private
/opt/splunk/etc/users/[myuserID]/testapp/lookups/test.csv
which is the default state when you upload a lookup. You should change the permission to app before you do the outputlookup.
Hello,
You said "You should change the permission to app before you do the outputlookup"
Do you mean to change the permission to the app, not the CSV file?
If so, can you please give me an example? Note that I am not the admin
Thank you
Before outputlookup - no CSV file
After outputlookup - CSV file exists - but I cannot change the permission (it's greyed out)
/opt/splunk/etc/users/[myuserID]/testapp/lookups/test.csv
When you said you did this
I added a new lookup by uploading the CSV file by going to Lookups » Lookup table files » Add new
the CSV file was uploaded to this this directory and I can change the permission
When you upload the CSV the list of lookups will show your lookup as private
you can then change the permissions to app, which MOVES the file system location of that file to the location inside the app.
Then when you run outputlookup, you will be updating the one in the app folder, which you have previously set to app permission.
Your suggestion worked!!
Thank you so much for your help
If this is a known consistent csv you are going to create, then create a new lookup of that name and upload a dummy csv. You can then define the permissions on the csv and outputlookup will then not change those permissions.