Edit a Lookup File

After you add a lookup file to the Splunk App for Lookup File Editing, you can locate, open, and then edit that lookup file. You can also restore an earlier version of a lookup file using the version history.

To edit a lookup file in the Splunk App for Lookup File Editing, complete the following steps:

  1. On the Lookups page, locate the file you want to edit from the list of imported CSV file and KV store lookups. You can filter the list to help find a particular lookup. This image shows the Lookups tab of the Splunk App for File Lookup Editing. This tab displays a list view of your CVS and KV store lookups. Filter enable you to narrow the list to only show lookups of a certain type or for a certain app. One listed lookup is highlighted as the one selected for editing.
  2. Select the name of the lookup file you want to edit. The file opens in an edit view.
  3. Select anywhere within the table to see the editing options, or select any individual field. This image shows the lookup we selected from the Lookups tab but in an edit view. The content is displayed like a spreadsheet and can be edited like a spreadsheet. Right-clicking displays a list of available options including insert a row, and insert a column. In the bottom right of the page a button labeled as Save Lookup is highlighted.
  4. Make your changes to the file.
  5. Select Save Lookup.
  6. (Optional) If you made an error or need to view a previous version of the file, select the version you want from the Revert to previous version drop-down list. Then select Save Lookup to restore that version. This image shows the same edit view of the lookup file but with the menu open for Revert to a previous version.