What is the difference between a "lookup" and a "lookup file"?

[jkotula]

Wildly frustrated poring over the Splunk documentation -- there are absolutely no good introductions to any topic! Anyway...

I've got a simple JSON file:

[
  {"acct": 1333, "name": "Customer 1"},
  {"acct": 1334, "name": "Customer 2"},
]

That is updated daily by processes external to Splunk and I want to import it as a kv lookup (it'll get large over time) to convert account numbers to client names. I'm primarily using the web UI for administration, but have delved a little bit into using .conf files.

1. What is the difference between a "lookup" and a "lookup file"?
2. What should the format for the input JSON be? An object, an array of objects?
3. How do I import the file?

Any help appreciated!

[kamlesh_vaghela]

@jkotula

1) What is the difference between a "lookup" and a "lookup file"?
You can find your answer from below links.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/LookupexampleinSplunkWeb
https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Lookup

2) What should the format for the input JSON be? An object, an array of objects?
Refer: https://dev.splunk.com/enterprise/docs/developapps/kvstore/usetherestapitomanagekv/

3) How do I import the file?
For your requirement, I sugest you to use the REST API to manage KV Store data. Use KV Store batch_save for run multiple save operations.

Refer Run multiple save operations: in below link.

https://dev.splunk.com/enterprise/docs/developapps/kvstore/usetherestapitomanagekv/

[jkotula]

Thanks. I'll look into the REST API. FWIW I had studied all these links before but that just makes my point about the lack of proper introductory/explanatory documentation. But thanks for your help!

[starcher]

You should write python and use the rest API to update the lookup in that situation. Look into the python sdk and kvstore examples.