Splunk Search

is there any way to edit an app-level lookup table

bjalex80
Explorer

I have a user who has created a lookup table and given it app-level permissions. Now the same user wants to add new entries to the lookup table. They can upload it as private, but cannot update the app-level table without deleting the existing one first. Any way around this that can be accomplished in the UI?

Tags (2)
0 Karma

mataharry
Communicator

You have 3 methods to edit lookup

  • Access the lookup file in the filesystem
  • Upload the new version of the lookup file in the UI (after changing the read permissions on the object in the UI)
  • Or a third method is to use a search to update the lookup table. inputlookup mylookup | append [ search to add my new lines ] | dedup uniquefields | outputlookup mylookup

so if the issue is a permission issue, have an admin change the permissions on the lookup file/definition for a role, and add the user to this role.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...