Edit a Lookup File
Once you have a lookup file added to the app, it is easy to find, open, and edit that lookup file. And if you need to view a lookup file prior to edits being made, the app maintains a version history.
Open the Splunk App for Lookup File Editing. You will land on the Lookups tab. A list of imported CSV and KV store lookups are listed. Use the available filter and open find by field to narrow the list as needed to find the file you need to edit.
Click the name of the lookup file you want to edit.
The file opens in an edit view. Much like with the Excel interface, right click on the table to see the editing options. Or just click into any individual field to edit content. Click Save Lookup when ready.
If you have made an error or need to view the file as it was before the saved changes, choose the Revert to previous version menu and select the preferred version listed. Then click Save Lookup again.
Create a new lookup in the Splunk App for Lookup File Editing
Troubleshoot the Splunk App for Lookup File Editing
This documentation applies to the following versions of Splunk® App for Lookup File Editing: 3.6.0