Splunk® App for Lookup File Editing

User Guide

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® App for Lookup File Editing. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

About the Splunk App for Lookup File Editing

Use the Splunk App for Lookup File Editing to add and edit lookup files within the Splunk platform. Using the app, you can edit, import, and export both KV store and CSV file lookups in an interface similar to Microsoft Excel.

With the Splunk App for Lookup File Editing, you can do the following:

  • Manage lookup files from within the Splunk platform
  • Import CSV files into a lookup
  • Import KV store data into a lookup
  • Edit lookups within a GUI similar to Microsoft Excel
  • View or restore lookups using revision history

The Splunk App for Lookup File Editing also enables your lookups to work on search head cluster environments. Any edits you make to lookups propagate to your other search heads.

This image shows an example of a populated screen of the Splunk App for Lookup File Editing. The interface resembles a spreadsheet with columns and rows to capture the name, type, and other details on each file listed. Options to filter the view are available.

Install the Splunk App for Lookup File Editing

Download the Splunk App for Lookup File Editing from Splunkbase. The Splunk App for Lookup File Editing is compatible with Splunk Enterprise and Splunk Cloud Platform versions 8.2 and 9.0.

This app does not require any configuration. You can install the app using the Splunk Apps Manager:

  1. Log in to Splunk Web and go to Apps > Manage Apps.
  2. Select Install app from file.
  3. Locate the downloaded app file and select Upload.
Last modified on 28 April, 2023
  NEXT
Navigate and use the Splunk App for Lookup File Editing

This documentation applies to the following versions of Splunk® App for Lookup File Editing: 3.6.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters