Splunk Search

is there any way to edit an app-level lookup table

bjalex80
Explorer

I have a user who has created a lookup table and given it app-level permissions. Now the same user wants to add new entries to the lookup table. They can upload it as private, but cannot update the app-level table without deleting the existing one first. Any way around this that can be accomplished in the UI?

Tags (2)
0 Karma

mataharry
Communicator

You have 3 methods to edit lookup

  • Access the lookup file in the filesystem
  • Upload the new version of the lookup file in the UI (after changing the read permissions on the object in the UI)
  • Or a third method is to use a search to update the lookup table. inputlookup mylookup | append [ search to add my new lines ] | dedup uniquefields | outputlookup mylookup

so if the issue is a permission issue, have an admin change the permissions on the lookup file/definition for a role, and add the user to this role.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...