Simply overwrite the csv file you are using in your lookup and Splunk will refresh its cache. Make sure the operation is transactional, that is, create a temp file first and once you finish writing to it copy it to the destination directory ... View more

Hi Jganger, I can't see your last comment here. There are probably too many nested comments and the website can't cope with them. In summary, protect your logs against tampering using tools outside of Splunk. If a user has local admin access to your machine it's always going to be complicated to prevent that so restrict your user rights first. ... View more