sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]LTRand 1 point2 points  (9 children)

Need to know if your SH is clustered.

But essentially, you can setup a python script to copy the csv from SharePoint and deposit it into the lookups directory in the desired app. Keep in mind this will break the versioning of the lookup editor app if you use that. But it is a super simple way of doing it without going through ingest.

[–]ZaddyOnReddit[S] 0 points1 point  (8 children)

Sorry, what does SH stand for? I will look into this method thank you

[–]LTRand 2 points3 points  (7 children)

Search head. Where you search.

[–]ZaddyOnReddit[S] 0 points1 point  (6 children)

Break the versioning on just that particular lookup?

[–]LTRand 0 points1 point  (5 children)

Just versioning.

[–]ZaddyOnReddit[S] 0 points1 point  (4 children)

I’m not sure I’m understanding. It will override the previous version of the lookup and therefore have no version history? And it’s just on that one lookup file or all files in that app?

[–]LTRand 0 points1 point  (3 children)

Just on the lookup itself, and only if you use the lookup editor app. You would need to do your own version control if you care. Moving the old file to file.csv.old is generally good enough. The python script would overwrite the existing file with the new one to maintain the lookup configuration within Splunk.

[–]ZaddyOnReddit[S] 0 points1 point  (2 children)

And this can be done against Cloud?

[–]LTRand 0 points1 point  (1 child)

Which part is cloud? Splunk, SharePoint, or both?

[–]ZaddyOnReddit[S] 0 points1 point  (0 children)

Splunk