Splunk Search

Lookup: CSV file

htkwan
Path Finder

Hello,
I've configured lookup, using a csv file. I've loaded the csv file, configure the lookup definition & automatic lookup. It works okay. When there are changes in th csv file (i.e. add in new rows), how can i do a reload? Thanks.

0 Karma

htkwan
Path Finder

Hello,
Thanks.

0 Karma

somesoni2
Revered Legend

If you've access to file system on your Splunk servers, you can update the lookup csv file directly from path $SPLUNK_HOME/etc/apps/YourAppName/lookups folder, no reload required.

If you don't, then you can use lookup editor apps such as "Lookup File Editor App" OR Lookup Updater dashboard of Sideview Utils.

Last option would be to delete the lookup table file and re upload with same name with updated content.

0 Karma

DMohn
Motivator

You can either restart your Splunk server, or use the debug/refresh URL ...

 http://splunkweb-url:8000/en-US/debug/refresh

This command will reload many static entities, such as lookups, transforms, ....
You can as well trigger the lookup entity directl., which can be done by one of the following commands (I'm not sure if the first one is sufficient, hence both - but you could try with the first one only)

 http://localhost:8000/en-US/debug/refresh?entity=admin/lookup-table-files
 http://localhost:8000/en-US/debug/refresh?entity=admin/transforms-lookup
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...