Hi guys,
I'm using a lookup table that is subject to the occasionally change. I've been trying to setup a weekly job to replace the existing file with a newer version but the batch job fails on 'access denied' because the file is apparently in use (by Splunk).
I'm trying to drop the csv file right on top of the other one and overwrite in \etc\apps\search\lookups
Is there anyway I can get around this or another angle I should take? Many thanks,
I've not known Splunk to lock lookup files, even while in use during a search. Is this on a Unix or a Windows indexer?
Best practice in this situation would probably be a multiple-setup process
These steps make your change more likely to be atomic and less likely to impact searches that are running during your update or that start while your update is happening.
Thanks I'll try these steps and report back. I assumed that if the file was locked then I wouldn't be able to rename either. It's a Windows server.
I was fairly certain credentials were in place but I'll investigate that again first if you feel Splunk shouldn't be locking the file.
Thanks I'll try these steps and report back. I assumed that if the file was locked then I wouldn't be able to rename either. It's a Windows server.
I was fairly certain credentials were in place but I'll investigate that again first if you feel Splunk shouldn't be locking the file.
I've not known Splunk to lock lookup files, even while in use during a search. Is this on a Unix or a Windows indexer?
Best practice in this situation would probably be a multiple-setup process
These steps make your change more likely to be atomic and less likely to impact searches that are running during your update or that start while your update is happening.