REST endpoints¶

The lookup Editor includes custom REST endpoints for editing lookup files.

Reading and Writing Lookup Contents¶

URL: /splunkd/__raw/services/data/lookup_edit/lookup_contents
Parameters:

• lookup_file: the name of the lookup file
• namespace: the app where the lookup is stored
• owner: the user name who owns the lookup in case you want to load a lookup that exists only for a particular user
• header_only: Only return the header row (defaults to false, return the entire lookup)
• version: the ID of the older version in case you want an older revision of the lookup (defaults to empty indicating that you want the latest version)
• lookup_type: the type of the lookup file (either "kv" or "csv")

The endpoint at /splunkd/__raw/services/data/lookup_edit/lookup_contents is used for editing and loading the contents of lookup files. A "GET" will retrieve the lookup and a "POST" will modify it. See https://github.com/LukeMurphey/lookup-editor/blob/master/src/bin/lookup_editor_rest_handler.py

This endpoint will return HTTP/420 if the lookup is larger than 10 MB.

Downloading a Lookup as a File¶

URL: /splunkd/__raw/services/data/lookup_edit/lookup_as_file
Parameters:

• lookup_file: the name of the lookup file
• namespace: the app where the lookup is stored
• owner: the user name who owns the lookup in case you want to load a lookup that exists only for a particular user
• header_only: Only return the header row (defaults to false, return the entire lookup)
• version: the ID of the older version in case you want an older revision of the lookup (defaults to empty indicating that you want the latest version)
• lookup_type: the type of the lookup file (either "kv" or "csv")

The endpoint at /splunkd/__raw/services/data/lookup_edit/lookup_as_file is to download the lookup as a file by including the headers that will cause a browser to download the file.