Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Lookup: CSV file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Lookup: CSV file
Hello,
I've configured lookup, using a csv file. I've loaded the csv file, configure the lookup definition & automatic lookup. It works okay. When there are changes in th csv file (i.e. add in new rows), how can i do a reload? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you've access to file system on your Splunk servers, you can update the lookup csv file directly from path $SPLUNK_HOME/etc/apps/YourAppName/lookups folder, no reload required.
If you don't, then you can use lookup editor apps such as "Lookup File Editor App" OR Lookup Updater dashboard of Sideview Utils.
Last option would be to delete the lookup table file and re upload with same name with updated content.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can either restart your Splunk server, or use the debug/refresh URL ...
http://splunkweb-url:8000/en-US/debug/refresh
This command will reload many static entities, such as lookups, transforms, ....
You can as well trigger the lookup entity directl., which can be done by one of the following commands (I'm not sure if the first one is sufficient, hence both - but you could try with the first one only)
http://localhost:8000/en-US/debug/refresh?entity=admin/lookup-table-files
http://localhost:8000/en-US/debug/refresh?entity=admin/transforms-lookup
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
Announcing Modern Navigation: A New Era of Splunk User Experience
