$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-lookupCSV and lookup file management for Splunk.
| 1 | # splunk-lookup |
| 2 | |
| 3 | CSV and lookup file management for Splunk. |
| 4 | |
| 5 | ## Purpose |
| 6 | |
| 7 | Upload, download, and manage CSV lookup files and lookup definitions. |
| 8 | |
| 9 | ## Risk Levels |
| 10 | |
| 11 | | Operation | Risk | Notes | |
| 12 | |-----------|------|-------| |
| 13 | | List lookups | - | Read-only | |
| 14 | | Get lookup info | - | Read-only | |
| 15 | | Download lookup | - | Read-only | |
| 16 | | Upload lookup | ⚠️ | Creates new or overwrites | |
| 17 | | Delete lookup | ⚠️⚠️ | May be recoverable from backup | |
| 18 | |
| 19 | ## Triggers |
| 20 | |
| 21 | - "lookup", "CSV", "upload" |
| 22 | - "lookup table", "enrichment" |
| 23 | |
| 24 | ## CLI Commands |
| 25 | |
| 26 | | Command | Description | |
| 27 | |---------|-------------| |
| 28 | | `lookup list` | List lookup files | |
| 29 | | `lookup get` | Get contents of a lookup file | |
| 30 | | `lookup upload` | Upload CSV lookup file | |
| 31 | | `lookup download` | Download lookup file | |
| 32 | | `lookup delete` | Remove lookup file | |
| 33 | | `lookup transforms` | List lookup transforms/definitions | |
| 34 | |
| 35 | ## Options |
| 36 | |
| 37 | | Option | Commands | Description | |
| 38 | |--------|----------|-------------| |
| 39 | | `-a`, `--app` | all | App context (defaults to "search" for most commands) | |
| 40 | | `-o`, `--output` | list, get, transforms | Output format (text, json; get also supports csv) | |
| 41 | | `-c`, `--count` | get | Maximum rows to show | |
| 42 | | `-n`, `--name` | upload | Lookup name (defaults to filename) | |
| 43 | | `-f`, `--force` | delete | Skip confirmation | |
| 44 | | `--output-file` | download | Output file path | |
| 45 | |
| 46 | ## App Context |
| 47 | |
| 48 | The `-a/--app` option specifies the Splunk app context: |
| 49 | |
| 50 | - **Optional for listing**: Filter results to a specific app |
| 51 | - **Required for upload**: Specifies where to store the lookup |
| 52 | - **Recommended for get/download/delete**: Ensures you target the correct lookup file |
| 53 | |
| 54 | Default behavior varies by command. When multiple apps have lookups with the same name, always specify `--app`. |
| 55 | |
| 56 | ## Examples |
| 57 | |
| 58 | ```bash |
| 59 | # List lookups (with output format) |
| 60 | splunk-as lookup list -a search |
| 61 | splunk-as lookup list -a search -o json |
| 62 | |
| 63 | # Get lookup contents (with count limit) |
| 64 | splunk-as lookup get users.csv -a search |
| 65 | splunk-as lookup get users.csv -a search -c 100 -o csv |
| 66 | |
| 67 | # Upload lookup (with custom name) |
| 68 | splunk-as lookup upload users.csv -a search |
| 69 | splunk-as lookup upload /path/to/data.csv -a search -n custom_lookup |
| 70 | |
| 71 | # Download lookup |
| 72 | splunk-as lookup download users.csv --output-file ./users.csv |
| 73 | |
| 74 | # Delete lookup (with force flag) |
| 75 | splunk-as lookup delete old_users.csv -a search |
| 76 | splunk-as lookup delete old_users.csv -a search -f |
| 77 | |
| 78 | # List lookup transforms/definitions |
| 79 | splunk-as lookup transforms -a search |
| 80 | splunk-as lookup transforms -a search -o json |
| 81 | ``` |
| 82 | |
| 83 | ## API Endpoints |
| 84 | |
| 85 | - `POST /services/data/lookup-table-files` - Upload |
| 86 | - `GET /services/data/lookup-table-files` - List |
| 87 | - `GET/DELETE /services/data/lookup-table-files/{name}` - Get/Delete |