Splunk Search

Lookup: CSV file

htkwan
Path Finder

Hello,
I've configured lookup, using a csv file. I've loaded the csv file, configure the lookup definition & automatic lookup. It works okay. When there are changes in th csv file (i.e. add in new rows), how can i do a reload? Thanks.

0 Karma

htkwan
Path Finder

Hello,
Thanks.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you've access to file system on your Splunk servers, you can update the lookup csv file directly from path $SPLUNK_HOME/etc/apps/YourAppName/lookups folder, no reload required.

If you don't, then you can use lookup editor apps such as "Lookup File Editor App" OR Lookup Updater dashboard of Sideview Utils.

Last option would be to delete the lookup table file and re upload with same name with updated content.

0 Karma

DMohn
Motivator

You can either restart your Splunk server, or use the debug/refresh URL ...

 http://splunkweb-url:8000/en-US/debug/refresh

This command will reload many static entities, such as lookups, transforms, ....
You can as well trigger the lookup entity directl., which can be done by one of the following commands (I'm not sure if the first one is sufficient, hence both - but you could try with the first one only)

 http://localhost:8000/en-US/debug/refresh?entity=admin/lookup-table-files
 http://localhost:8000/en-US/debug/refresh?entity=admin/transforms-lookup
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...