Install the Splunk App for Lookup File Editing

Download the Splunk App for Lookup File Editing from Splunkbase. The Splunk App for Lookup File Editing is compatible with Splunk Enterprise and Splunk Cloud Platform versions 8.2 and 9.0. This app does not require any configuration. To install the app, complete the following steps:

1. Log in to Splunk Web and go to Apps and then Manage Apps.
2. Select Install app from file.
3. Locate the downloaded app file and select Upload.

Set up the app on a search head cluster

To set up the app on a search head cluster, complete the following steps:

1. Install the Splunk App for Lookup File Editing on the search head cluster.
2. Use the deployer to distribute the app updates.
3. Open the $SPLUNK_HOME/etc/shcluster/apps/lookup_editor/default/restmap.conf file.
4. Turn on replication of the lookup backups by adding the following to the restmap.conf file:

   [global] allowRestReplay = true

   CSV file and KV store lookups replicate automatically by default, but you must manually turn on replication for lookup backups.

5. To push the search head cluster bundle, run the following command:

   splunk apply shcluster-bundle -target <SH-uri> -preserve-lookups true

   In this example, the value of SH-uri is https://<fqdn-of-any-sh>:8089.

After you set up the Splunk App for Lookup File Editing on the search head cluster, make sure that the app is distributed to all of the search heads and that your web-browsers are not caching older versions of the app.