Splunk Search

How to update a lookup file in Splunk from Phantom?

yadavameeth
Engager

How to update a lookup file in splunk from Phantom?

Labels (1)
Tags (1)

mthcht
Explorer

Hi i made these scripts to update or upload lookups on splunk using lookup-editor endpoint 

It can save the content of lookup(s) from splunk, add new fields and values or merge files and update them on splunk, you can use them in your playbooks

0 Karma

MuS
SplunkTrust
SplunkTrust

Okay, found the solution! 

It's not documented anywhere but the lookup definition in Splunk needs to be shared globally AND the owner of the lookup definition needs to be 'nobody' - also remember to set the permission of the CSV so everyone is able to write and share it globally as well. 

Hope this helps ...

cheers, MuS

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You could also simply call REST API to update lookup contents.

0 Karma

MuS
SplunkTrust
SplunkTrust

That did also not work for the same permission related reasons, but like I said it's working now.

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi there,

we encountered the exact same problem. Using the provided commands in the Splunk app in Phantom it seems there is no way to update a lookup table BUT we have a workaround for that 😉 If you are forwarding the Phantom event to Splunk you can use those events and run a scheduled search that will then update the lookup file.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...