Skip to content

scripts using splunk application lookup-editor endpoint. Download, upload and update splunk lookups content

Notifications You must be signed in to change notification settings

mthcht/lookup-editor_scripts

Repository files navigation

lookup-editor_scripts

  • Simple script using splunk application lookup-editor (renamed Splunk App for Lookup File Editing ) endpoint to upload multiple lookups at once: 2022-12-24 08_37_55-Windows 10 and later x64 - VMware Workstation
  • script using splunk application lookup-editor endpoint to update part of a lookup or multiple lookups:

Example of using the -p option (can be done with multiple lookups at once)

The lookup we have on splunk search app: 2022-12-26 23_09_01-Windows 10 and later x64 - VMware Workstation

Execution of the script (script asked for input, we paste the content in the terminal and typed 'ok' to confirm (can be done on multiple lookups at once): 2022-12-26 23_10_35-Windows 10 and later x64 - VMware Workstation 2022-12-26 23_11_05-Windows 10 and later x64 - VMware Workstation

result: 2022-12-26 23_11_27-Windows 10 and later x64 - VMware Workstation


Example of using the -i option (can be done with multiple lookups at once)

The lookup we have on splunk search app:

2022-12-26 22_32_47-Windows 10 and later x64 - VMware Workstation

Execution of the script (script asked for each input, can be done on multiple lookups at once):

2022-12-26 22_56_19-Windows 10 and later x64 - VMware Workstation

result: image


Example of merging two csv files with option -f

(not limited to 2 files, we can merge demo_file_to_merge to all the lookups we want on splunk):

The lookup we have on splunk search app:

image

The csv file on our desktop we want to merge to the lookup test.csv:

2022-12-26 21_48_00-Windows 10 and later x64 - VMware Workstation

Execution of the script to merge both files:

2022-12-26 21_54_20-Windows 10 and later x64 - VMware Workstation

result:

image


Example of merging tree csv files with option -f:

The lookups we have on splunk search app:

2022-12-26 22_18_27-Windows 10 and later x64 - VMware Workstation 2022-12-26 22_18_36-Windows 10 and later x64 - VMware Workstation

The csv file on our desktop we want to merge to the lookup test.csv and test2.csv:

2022-12-26 22_22_57-Windows 10 and later x64 - VMware Workstation

Execution of the script to the files:

2022-12-26 22_25_22-Windows 10 and later x64 - VMware Workstation 2022-12-26 22_25_57-Windows 10 and later x64 - VMware Workstation 2022-12-26 22_26_08-Windows 10 and later x64 - VMware Workstation

result:

2022-12-26 22_27_01-Windows 10 and later x64 - VMware Workstation 2022-12-26 22_27_12-Windows 10 and later x64 - VMware Workstation

  • Simple script using splunk application lookup-editor endpoint to download lookup(s) from splunk:

no arguments (use default values declared in the script) 2022-12-27 19_04_48-Windows 10 and later x64 - VMware Workstation

with arguments: 2022-12-27 19_10_50-Windows 10 and later x64 - VMware Workstation

[update 2023/05] you can also check out the script https://github.com/beckyburwell/splunk_rest_upload_lookups using the same endpoint API

About

scripts using splunk application lookup-editor endpoint. Download, upload and update splunk lookups content

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages