hi @umplebyj, I believe it is possible if your hardware (Packet Broker, monitoring switch, etc) supports this. The obvious caveat is that you'd still be using only ingress (Rx) bandwidth on your capture port, so you will need to make sure you're not overloading it with the merged traffic. Stream can also monitor two separate ports (one for ingress and the other for egress part of the traffic) as a part of a single monitoring setup. I'd recommend this approach unless you have specific reasons against it. HTH ... View more

Solved the issue here: create the new lookup file, and drop it into /opt/splunk/var/run/splunk/lookup_tmp/ on linux chown the file Then run the web api to delete the current instance, upload the new one, and move it to all permissions curl -k -u admin:changeme --request DELETE https://server:8089/servicesNS/admin/app/data/lookup-table-files/file.csv curl -k -u admin:changeme https://server:8089/servicesNS/admin/app/data/lookup-table-files -d eai:data=/opt/splunk/var/run/splunk/lookup_tmp/file.csv -d name=file.csv curl -k -u admin:changeme https://server:8089/servicesNS/admin/app/data/lookup-table-files/acl -d owner=admin -d sharing=global -d perms.read=* ... View more