Splunk® App for Lookup File Editing

User Guide

Getting started with the Splunk App for Lookup File Editing

Using the Splunk App for Lookup File Editing, you can edit, import, and export KV store and CSV file lookups in an interface similar to Microsoft Excel.

Use the Splunk App for Lookup File Editing to complete the following tasks:

  • Review your saved lookup files
  • Create new lookups
  • Review lookup file metrics and logs with dashboards
  • Run Splunk searches and explore your data

Review your saved lookup files

Select the Lookups tab to view a list of your saved lookup files. You can sort the view by selecting any column header. You can also search for a particular lookup file or filter the lookup file list by share settings, lookup type, affiliated app, or name. For example, select Mine to filter for lookups owned by you.

This image shows the Lookups tab of the Splunk App for Lookup File Editing App.

Select the name of a lookup to view and edit that lookup. Depending on your app permissions, you can also export, open in search, and delete any lookup file using the Actions icons on the lookups table.

To find the size of a lookup or the total backup size for a lookup, hover over the lookup in the lookups table.

To turn on or turn off a KV store lookup file, select the toggle switch in the Actions column of the lookups table. Confirm that you want to turn off a lookup file by selecting Turn off.

Create new lookups

Select the New Lookup tab to create a new CSV file or KV store lookup. For step-by-step instructions, see Create a new lookup in the Splunk App for Lookup File Editing.

This image shows the New Lookup tab of the Splunk App for Lookup File Editing App. There is an option to create a new lookup from a CSV and another option to create a new lookup from the KV store.

Review lookup file metrics and logs with dashboards

Select the Health tab to view the latest log and debug information. You can select the following views:

View What you can do
Overview Manage your lookup files using metrics and visualizations on lookup file size, backups, and more. For example, you can track CSV lookups using a table visualization sorted by total backup size.
Logs Select a time range and severity type for your logs. Dashboard panels include Logs by Severity (over time), Log Severity, and Latest Log. You can select results within these panels to open a new search.
Status See the current status of the Splunk App for Lookup File Editing.

The application does not work if one of the REST Handlers is offline.

This image shows the Health tab of the Splunk App for Lookup File Editing App. There are three options within the tab drop-down menu: Overview, Logs, and Status. This image shows the Overview page.

Run Splunk searches and explore your data

Select the Search tab to run a Splunk search and explore you datasets, reports, alerts, and dashboards. These resources are not limited to the Splunk App for Lookup File Editing.

This image shows the Search tab of the Splunk App for Lookup File Editing App.

Last modified on 17 April, 2023
Install the Splunk App for Lookup File Editing   Create a new lookup in the Splunk App for Lookup File Editing

This documentation applies to the following versions of Splunk® App for Lookup File Editing: 4.0.1, 4.0.2, 4.0.4


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters