Splunk® App for Lookup File Editing

User Guide

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Edit a Lookup File

Once you have a lookup file added to the app, it is easy to find, open, and edit that lookup file. And if you need to view a lookup file prior to edits being made, the app maintains a version history.

Open the Splunk App for Lookup File Editing. You will land on the Lookups tab. A list of imported CSV and KV store lookups are listed. Use the available filter and open find by field to narrow the list as needed to find the file you need to edit.

This image shows the Lookups tab of the Splunk App for File Lookup Editing. This tab displays a list view of your CVS and KV store lookups. Filter enable you to narrow the list to only show lookups of a certain type or for a certain app. One listed lookup is highlighted as the one selected for editing.

Click the name of the lookup file you want to edit.

This image shows the lookup we selected from the Lookups tab but in an edit view. The content is displayed like a spreadsheet and can be edited like a spreadsheet. Right-clicking displays a list of available options including insert a row, and insert a column. In the bottom right of the page a button labeled as Save Lookup is highlighted.

The file opens in an edit view. Much like with the Excel interface, right click on the table to see the editing options. Or just click into any individual field to edit content. Click Save Lookup when ready.

This image shows the same edit view of the lookup file but with the menu open for Revert to a previous version.

If you have made an error or need to view the file as it was before the saved changes, choose the Revert to previous version menu and select the preferred version listed. Then click Save Lookup again.

Last modified on 14 May, 2022
Create a new lookup in the Splunk App for Lookup File Editing
Troubleshoot the Splunk App for Lookup File Editing

This documentation applies to the following versions of Splunk® App for Lookup File Editing: 3.6.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters