- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to set up a csv lookup file I update daily...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to set up a csv lookup file I update daily to be referenced by searches without having to redefine it?
Hello Splunkers,
Question: I have a lookup working properly on a .csv file but I appear to have correctly assumed that once I define the lookup file and then I update the lookup file with the day's fresh copy, my Splunk searches would automatically reference the new .csv file without me having to redefine it. This appears to not be the case.
Is this possible to setup? Should I be using Automatic Lookups or will I need to redefine the lookup file every time I have a new .csv to reference?
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, thanks for your assistance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk makes a local copy of any csv you use in a lookup, so you'll have to update the local copy on the Splunk server if you are going to do it that way.
If the updated csv is the result of a search, may I suggest you look into the outputlookup command, and simply overwrite or append to your existing lookup.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the reply, AH.
The .csv file is not the result of a search.
So Splunk does not have the capability to update the local copy of the .csv file at all unless I manually re-add it, is that corect? What is an automatic lookup?
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You know the "lookup" command right? it's basically a join against a lookup table. An automatic lookup, you define against a sourcetype / source and will do this join automatically without the need for the lookup command in your search. It has nothing to do with updating the lookup content.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, thanks for your assistance.
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
Updated Data Management and AWS GDI Inventory in Splunk Observability
