Splunk® App for Lookup File Editing

User Guide

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Create a new lookup in the Splunk App for Lookup File Editing

The Splunk App for Lookup File Editing provides an Excel-like interface for editing, importing, and exporting KV store and CSV-based lookup files.

Perform the following steps to create a new lookup in the app:

  1. Log into Splunk Web.
  2. From the Apps listing, select the Splunk App for Lookup File Editing.
  3. On the resulting Lookups tab, choose the New Lookup tab, or the Create New Lookup button on the right of the screen. The button provides the choice of a KV store or CSV lookup. This example uses the New Lookup tab. This image shows the Lookups tab of the Splunk App for Lookup File Editing. The Create a New Lookup menu button is highlighted. From this menu you can select a KV store lookup or CSV lookup option.
  4. From the New Lookup tab, choose to create a CSV or KV store lookup. This example selects CSV. This image shows the New Lookup tab of the Splunk App for Lookup File Editing. There are options here for either a CSV or KV store lookup. In this example, the CSV option is selected.
  5. On the New Lookup page, click the Import button. From the resulting window you can upload your CSV file or drag and drop. This image shows the New Lookup screen for a new CSV lookup. An button labeled Import has been selected which results in a modal window. In this modal window you can select a CSV file to import from your computer or choose to drag and drop the CSV file in directly.
  6. Once imported, right click anywhere within the table to make edits. Select the User-only box to keep the lookup private. This image shows the New Lookup tab following the import of an example CSV. The resulting table can be used in similar ways to an Excel spreadsheet. Right-clicking within the table opens edit options. Options include the ability to insert a new column, delete a column, rename a column, and insert a new row.

    CSV files can only use one cell delimiter in order to properly import and separate your data into columns. If your data is not separating into columns correctly, check the CSV for values such as semicolons or pipes that may be misidentified as delimiters.

  7. Using the keyword of high, medium, or low will color code the corresponding fields. This image shows the New Lookup tab following the import of an example CSV. In this example a new column has been added and named Urgency. In this column is a row labeled high, a row labeled medium, and a row labeled low. When used, these field names auto-fill with a corresponding color - high in orange, medium in yellow, and low in green.

  8. Click Save Lookup when done.

Follow similar steps when creating a new lookup from the KV store. The New Lookup page has a slightly different user interface. This image shows the screen for when you select to add a new KV Store lookup rather than a CSV.

Last modified on 12 May, 2022
PREVIOUS
Navigate and use the Splunk App for Lookup File Editing
  NEXT
Edit a Lookup File

This documentation applies to the following versions of Splunk® App for Lookup File Editing: 3.6.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters