Splunk Apps » Lookup Editor

h1. FAQ

h2. How do I audit changes to the lookup files?

The lookup editor keeps a log that is indexed into the _internal index. You can view that logs like this:

<pre>

index=_internal "Lookup edited successfully" | table _time user namespace lookup_file

</pre>

h2. My lookup file cannot be opened, why not?

Look into the logs to see if there is a reason given why the files are not loading:

<pre>

index=_internal source=*lookup_editor_controller.log

</pre>

h2. How do I enable replicating of the lookup file backups to other search heads when using a Search Head Cluster?

You can enable replication of the lookup backups by using the REST replay feature. To enable this, add the following in restmap.conf (in $SPLUNK_HOME/etc/shcluster/lookup_editor/default/restmap.conf):

<pre>

[global]

allowRestReplay = true

</pre>

This will work on Splunk 6 from (6.3+) and on Splunk 7.1+. +*However, do not enable*+ this on Splunk 7.0 (7.0 to 7.0.3) because there is a bug in Splunk 7.0 that causes REST replay to crash splunkd.