Hi i made these scripts to update or upload lookups on splunk using lookup-editor endpoint
It can save the content of lookup(s) from splunk, add new fields and values or merge files and update them on splunk, you can use them in your playbooks
Okay, found the solution!
It's not documented anywhere but the lookup definition in Splunk needs to be shared globally AND the owner of the lookup definition needs to be 'nobody' - also remember to set the permission of the CSV so everyone is able to write and share it globally as well.
Hope this helps ...
cheers, MuS
You could also simply call REST API to update lookup contents.
That did also not work for the same permission related reasons, but like I said it's working now.
cheers, MuS
Hi there,
we encountered the exact same problem. Using the provided commands in the Splunk app in Phantom it seems there is no way to update a lookup table BUT we have a workaround for that 😉 If you are forwarding the Phantom event to Splunk you can use those events and run a scheduled search that will then update the lookup file.
Hope this helps ...
cheers, MuS