I have a lookup created from a CSV file.
i put in entries
1
2
3
4
5
When i do a search, i can find these values.
now ,next day i add a new entry 6 and save the csv file.
i dont see the search showing 6, it only shows 1-5
can you help me fix this, it seems the lookup file updates are not being honored...
you can place your lookup file in the below directory and can access from search query
location:
D:\Program Files\Splunk\etc\apps\search\lookups\example.csv
search query :
|inputlookup example.csv
Yes, this is exactly how i have done it.
now when i do changes to this file, i dont see the changes.
|inputlookup file.csv
Found the answer.
i had the same lookup name file from 2 different locations . i was updating one of the file and so that was considered by splunk as not primary , so it was not showing.
i delete the duplicate entry and now i can see the new entry...