Create a new lookup in the Splunk App for Lookup File Editing
Using the Splunk App for Lookup File Editing, you can edit, import, and export KV store and CSV file lookups in an interface similar to Microsoft Excel.
To create a new lookup in the Splunk App for Lookup File Editing, complete the following steps:
- Log in to Splunk Web.
- From the Apps listing, select the Splunk App for Lookup File Editing.
- On the resulting Lookups tab, select the New Lookup tab or the Create New Lookup button. The following steps use the New Lookup tab as an example.
- From the New Lookup tab, select either Create CSV Lookup or Create KV Store Lookup. The following steps use the CSV file lookup option as an example.
- On the New Lookup page, select the Import button. In the resulting dialog box, you can upload your CSV file or drag and drop it.
- After the CSV file imports, select anywhere within the table to make edits. Select the User-only check box to keep the lookup private.
CSV files can use only one cell delimiter to correctly import and separate data into columns. If your data does not separate into columns correctly, check the CSV file for values such as semicolons or pipes that might misidentify as delimiters.
- Select Save Lookup.
The process for creating a CSV file lookup is similar to the process for creating a KV store lookup. When you create a KV store lookup rather than a CSV file lookup, there are some differences in the user interface of the New Lookup page.
Navigate and use the Splunk App for Lookup File Editing
Edit a Lookup File
This documentation applies to the following versions of Splunk® App for Lookup File Editing: 3.6.0