How to update a lookup file in Splunk from Phantom?

[yadavameeth]

How to update a lookup file in splunk from Phantom?

[mthcht]

Hi i made these scripts to update or upload lookups on splunk using lookup-editor endpoint 

It can save the content of lookup(s) from splunk, add new fields and values or merge files and update them on splunk, you can use them in your playbooks

[MuS]

Okay, found the solution! 

It's not documented anywhere but the lookup definition in Splunk needs to be shared globally AND the owner of the lookup definition needs to be 'nobody' - also remember to set the permission of the CSV so everyone is able to write and share it globally as well. 

Hope this helps ...

cheers, MuS

[PickleRick]

You could also simply call REST API to update lookup contents.

[MuS]

That did also not work for the same permission related reasons, but like I said it's working now.

cheers, MuS

[MuS]

Hi there,

we encountered the exact same problem. Using the provided commands in the Splunk app in Phantom it seems there is no way to update a lookup table BUT we have a workaround for that 😉 If you are forwarding the Phantom event to Splunk you can use those events and run a scheduled search that will then update the lookup file.

Hope this helps ...

cheers, MuS