If you really want to maintain a lookup via the rest API the lookup has to be a kvstore lookup. CSV lookups cannot be directly modified. You can use python to read in the csv file but use the REST API to control a kvstore lookup. Similar to this: https://github.com/georgestarcher/Splunk-ESIntel-KVStore ... View more

This is close to what I am looking for, however all of the predictions are equal to 0 and it seems to predict on all of the domains counted together. Is it possible to predict based on only one value inside the query field? ... View more