Splunk Search
Highlighted

Lookup: CSV file

Path Finder

Hello,
I've configured lookup, using a csv file. I've loaded the csv file, configure the lookup definition & automatic lookup. It works okay. When there are changes in th csv file (i.e. add in new rows), how can i do a reload? Thanks.

0 Karma
Highlighted

Re: Lookup: CSV file

Motivator

You can either restart your Splunk server, or use the debug/refresh URL ...

 http://splunkweb-url:8000/en-US/debug/refresh

This command will reload many static entities, such as lookups, transforms, ....
You can as well trigger the lookup entity directl., which can be done by one of the following commands (I'm not sure if the first one is sufficient, hence both - but you could try with the first one only)

 http://localhost:8000/en-US/debug/refresh?entity=admin/lookup-table-files
 http://localhost:8000/en-US/debug/refresh?entity=admin/transforms-lookup
0 Karma
Highlighted

Re: Lookup: CSV file

SplunkTrust
SplunkTrust

If you've access to file system on your Splunk servers, you can update the lookup csv file directly from path $SPLUNK_HOME/etc/apps/YourAppName/lookups folder, no reload required.

If you don't, then you can use lookup editor apps such as "Lookup File Editor App" OR Lookup Updater dashboard of Sideview Utils.

Last option would be to delete the lookup table file and re upload with same name with updated content.

0 Karma
Highlighted

Re: Lookup: CSV file

Path Finder

Hello,
Thanks.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.