FAQ¶

How do I audit changes to the lookup files?¶

The lookup editor keeps a log that is indexed into the _internal index. You can view that logs like this:

index=_internal "Lookup edited successfully" | table _time user namespace lookup_file

My lookup file cannot be opened, why not?¶

Look into the logs to see if there is a reason given why the files are not loading:

index=_internal source=*lookup_editor_controller.log

How do I enable replicating of the lookup file backups to other search heads when using a Search Head Cluster?¶

You can enable replication of the lookup backups by using the REST replay feature. To enable this, add the following in restmap.conf (in $SPLUNK_HOME/etc/shcluster/lookup_editor/default/restmap.conf):

[global]
allowRestReplay = true

This will work on Splunk 6 from (6.3+) and on Splunk 7.1+. However, do not enable this on Splunk 7.0 (7.0 to 7.0.3) because there is a bug in Splunk 7.0 that causes REST replay to crash splunkd.