Splunk Search

Update lookup files

karthik7411
New Member

hi, i have already uploaded a csv lookup file to the splunk indexer. Now i want to add more entries to the csv file. i goto the destination where it is stored on the indexer and open it and edit and save it and restart splunk. then from my web interface if i do a | input lookup the newly added entries are not displayed. Can some one help me out??

Thanks in Advance!!!

Tags (3)
0 Karma

Kate_Lawrence-G
Contributor

Hi,

Lookup tables are typically stored at the search head and not the indexer. Is this an indexer & search head instance (i.e. doing both?)

You can verify lookups from the search head by going under the Manager -> Lookups ad see where you file is listed and can verify the file contents by logging into the box and taking a look at that path.

@Kate

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...