Splunk Search

is there any way to edit an app-level lookup table

bjalex80
Explorer

I have a user who has created a lookup table and given it app-level permissions. Now the same user wants to add new entries to the lookup table. They can upload it as private, but cannot update the app-level table without deleting the existing one first. Any way around this that can be accomplished in the UI?

Tags (2)
0 Karma

mataharry
Communicator

You have 3 methods to edit lookup

  • Access the lookup file in the filesystem
  • Upload the new version of the lookup file in the UI (after changing the read permissions on the object in the UI)
  • Or a third method is to use a search to update the lookup table. inputlookup mylookup | append [ search to add my new lines ] | dedup uniquefields | outputlookup mylookup

so if the issue is a permission issue, have an admin change the permissions on the lookup file/definition for a role, and add the user to this role.

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...