Lookup: CSV file

[htkwan]

Hello,
I've configured lookup, using a csv file. I've loaded the csv file, configure the lookup definition & automatic lookup. It works okay. When there are changes in th csv file (i.e. add in new rows), how can i do a reload? Thanks.

[htkwan]

Hello,
Thanks.

[somesoni2]

If you've access to file system on your Splunk servers, you can update the lookup csv file directly from path $SPLUNK_HOME/etc/apps/YourAppName/lookups folder, no reload required.

If you don't, then you can use lookup editor apps such as "Lookup File Editor App" OR Lookup Updater dashboard of Sideview Utils.

Last option would be to delete the lookup table file and re upload with same name with updated content.

[DMohn]

You can either restart your Splunk server, or use the debug/refresh URL ...

 http://splunkweb-url:8000/en-US/debug/refresh

This command will reload many static entities, such as lookups, transforms, ....
You can as well trigger the lookup entity directl., which can be done by one of the following commands (I'm not sure if the first one is sufficient, hence both - but you could try with the first one only)

 http://localhost:8000/en-US/debug/refresh?entity=admin/lookup-table-files
 http://localhost:8000/en-US/debug/refresh?entity=admin/transforms-lookup