How to update a lookuptable?

[Abass42]

So I couldn't find anything in splunk community that answers my question about pushing an update to a lookup table. I manually updated the .csv file through the backend searchhead server. I deleted a line and replaced it with another hostname. 

When i run the command:

|inputlookup dns_hosts.csv| stats count by host|eval count=0|join host type=outer [ search index="dns"|stats count by host]|fillnull|where count=0|fields  host count

Im still getting the host that has a count of 0, the host that i removed in the csv file. My question is do i need to restart the searchhead to push that change? I didnt change any config files, just the lookupfile under the specific app directory's lookup file folder. I wasnt sure if splunk would automatically read the updated file after a certain amount of time, or if i needed to restart the server for it to take effect? And will that file replicate across all searchheads after I restart it? 

Thank you for any guidance. 

[somesoni2]

Splunkbase has a great app for updating lookup table from UI.

https://splunkbase.splunk.com/app/1724

This uses REST APIs I believe so updates do not require refresh/restart. Check that app out.

[PickleRick]

That's another story 😉 But yes, the app is quite useful (even if a bit clunky).

[PickleRick]

1) If you do manual changes to the files on splunk nodes, sometimes they get reloaded on their own, sometimes they don't (they usually do in the end but it may take some time). It's better to force a refresh. See https://community.splunk.com/t5/Security/When-you-run-debug-refresh-what-does-it-refresh/m-p/610498

Some settings however are never applied without full restart.

2) If you have a search-head cluster, you should push your changes via the deployer. If however you have several non-connected search-heads, you have to apply the config change to each one of them. Either manually or - if you're using deployment server - by distributing new version of an app via DS.