Splunk Search

update data / lookup

New Member

Hello everyone,
I would like to get some help.

I have a LDAP in my organization, containing data of users, their authorizations, date of change etc..
I have exported a static list containing the data, and I export an updated list every once in a while.

I can't index he data again, since it will cause duplicates.

I made a lookup table and a lookup definition, but when I exported a new list and changed it from the folders in splunk, my searches didn't work anymore. There was a warning saying it could not find the file and the SID ( even though I named it the same as the old file).

It worked again only when I changed the file in the lookup table.

What can I do so when I update the list in the splunk folders I won't need to change the file in the lookup table?
Is there a way to make it automatic?

I thought of making an automatic lookup, but the whole data I need is inside the lookup table so I have nothing to write in the 'lookup input fields'.

Thank you,
Sabina.

0 Karma