Lookup backups?

[zzqzzqzzq]

Any thoughts about adding lookup backups to the mix as well?

All it takes is an errant search command, and poof..... Especially when doing "|inputlookup lookup | doStuff | outputlookup lookup"

(Yeah I know the Lookup Editor does lookup backups, but only for things being edited with it.)

Thanks,

David

[gjanders]

It's a good idea! The reason I didn't try to do it originally is because the Splunk API does not have any method to upload/download lookup files!

What I later found was that the lookup editor had a REST API that could do it, but that was after I had completed the work and I didn't test it.

Fortunately, others did:
https://github.com/mthcht/lookup-editor_scripts
https://github.com/beckyburwell/splunk_rest_upload_lookups

Both have scripts here!

Perhaps one of those would work well?
I could integrate one of those into the script but I have other work on at the moment.

[zzqzzqzzq]

Hey,

I'd love to have everything all in one place under our Splunk Version Control git directories, but it looks like mthcht's scripts will give me something to start with. I especially like what appears to be a "download all visible lookups" aspect of them.

Appreciate the pointers, I wasn't aware of those scripts.

(Feel free to close this, or leave it open as a todo reminder.)

Thanks again and cheers!

David

[gjanders]

I'll leave it open in case someone wants to contribute code here :).

Other team members wrote a daily backups of lookup files but having it a more "version controlled" fashion rather than a .tar.gz dump of lookup files at a point in time would be nice...