Is there a way to view the contents of saved csv on a lookup table from Splunk Web?

[kuga_mbsd]

hi there,
I am still new to Splunk.
There are some csv saved on lookup table, but I don't have admin access to the Splunk Linux host, so unable to take a look.
Is there anyway from splunk web?

[MuS · Accepted solution]

Hi kuga_mbsd,

you can try the commands inputcsv http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputcsv or inputlookup http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Inputlookup and see what you get back from it.

Be aware, that you either need to know the file name for inputcsv or the lookup definition name for inputlookup and not to forget you need to have at least read access to the files.

Hope that helps ...

cheers, MuS

[kuga_mbsd]

Thank you, MuS,

I tried inputcsv, but the csv file is not located under $SPLUNK_HOME/var/run and got error "/opt/splunk/var/run/ACUTUAL/PATH/I/ENTER/AAA.csv"...

how can I specify the file path?

[Arun_N_007]

Hi,

|inputlookup will work only when it is present in the lookups folder of an app. It also depends on the permissions. If lookup is private it will be readable by that specific user. Check its properties and permissions in Lookups section in Splunk Web.

[kuga_mbsd]

Thank you, both MuS and Arun_N_007.

inputlookup just works!
It just took too long since csv has almost 100K lines, so I thought it wasn't working.

Thanks again.

[MuS]

This is not possible with inputcsv, it only allows to read cvs files in $SPLUNK_HOME/var/run/splunk

Did you try inputlookup already?