Splunk Search

Update lookup files

New Member

hi, i have already uploaded a csv lookup file to the splunk indexer. Now i want to add more entries to the csv file. i goto the destination where it is stored on the indexer and open it and edit and save it and restart splunk. then from my web interface if i do a | input lookup the newly added entries are not displayed. Can some one help me out??

Thanks in Advance!!!

Tags (3)
0 Karma

Contributor

Hi,

Lookup tables are typically stored at the search head and not the indexer. Is this an indexer & search head instance (i.e. doing both?)

You can verify lookups from the search head by going under the Manager -> Lookups ad see where you file is listed and can verify the file contents by logging into the box and taking a look at that path.

@Kate

0 Karma