Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Lookup File Editor
MD5 checksum (lookup-file-editor_271.tgz) 23f80f547a67865f92c30ab911e45f41 MD5 checksum (lookup-file-editor_270.tgz) 1289bbc0ed49d307812f37b73342a099 MD5 checksum (lookup-file-editor_262.tgz) ceaafb95858fd368b56749d03680ab92 MD5 checksum (lookup-file-editor_261.tgz) 7a4b7b669d76e3aa957b2d935972dc41 MD5 checksum (lookup-file-editor_260.tgz) b679b93f6fe3f071424049d4f61fa106 MD5 checksum (lookup-file-editor_250.tgz) e20d6a6dd42ae7236914fe6e3214cebf MD5 checksum (lookup-file-editor_240.tgz) 504451968a85b911ddf1263a354a1b84 MD5 checksum (lookup-file-editor_234.tgz) 2afcf3437dc46f574d7d7f1ae160108c MD5 checksum (lookup-file-editor_233.tgz) 2e1c8ea8e3f190d7b04cbbe275fb06d7 MD5 checksum (lookup-file-editor_232.tgz) 85035145680b07aba588f3ab10f26c3a MD5 checksum (lookup-file-editor_231.tgz) 5f3d69293a7a89af92c43307a25b6de3 MD5 checksum (lookup-file-editor_23.tgz) be0a8bcd39fa5b4bc5cbe6ac7663cc8a MD5 checksum (lookup-file-editor_22.tgz) c4506074e1773b104b8bc389f056ae58 MD5 checksum (lookup-file-editor_212.tgz) 93d178651a0cdc15b78aa59a6f2eef37 MD5 checksum (lookup-file-editor_211.tgz) 7c735709d06c78fbe88db7681c4690be MD5 checksum (lookup-file-editor_210.tgz) ea908e08f873982140142912be327540 MD5 checksum (lookup-file-editor_203.tgz) 2153edcde17712eae7424392a1f9fbe0 MD5 checksum (lookup-file-editor_202.tgz) 352e96491a30f2458f21b1e22efcbb1b MD5 checksum (lookup-file-editor_201.tgz) 0dcb4f7217e7044561d59ed9d74aa859 MD5 checksum (lookup-file-editor_200.tgz) 503fd1fab66a21a6e59d666777eeae8d MD5 checksum (lookup-file-editor_141.tgz) 54f16dd4487afb3599c675aaf430c8e4 MD5 checksum (lookup-file-editor_140.tgz) 7ba6786da12852b09524597ac1b26073 MD5 checksum (lookup-file-editor_131.tgz) 6fe46b71a478371782b7e7e2975c8120 MD5 checksum (lookup-file-editor_13.tgz) eb82946fd7bc55d5b294bd2a466c9faa MD5 checksum (lookup-file-editor_12.tgz) 2faef05f57eeea943f8205a7cdc7269d MD5 checksum (lookup-file-editor_11.tgz) 0395c3cb2ce23f9d16bbfefba720d40f MD5 checksum (lookup-file-editor_10.tgz) 0c53e001082c8d21a5000176471146c4 MD5 checksum (lookup-file-editor_07.tgz) 3aa2a7f154eb1f0458408e2b62aaf759 MD5 checksum (lookup-file-editor_06.tgz) 495d95fe804b2e820165c8c85dc236c3 MD5 checksum (lookup-file-editor_05.tgz) 06bdf91b2802dfd1051b054ac8763ef6
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Lookup File Editor

Ever want to edit a lookup within Splunk with a user-interface? Now you can. This app provides an Excel-like interface for editing, importing, and exporting lookup files (both KV store and CSV based lookups).

This app makes your lookups work on a Search Head Clustered environments too (edits to lookups will be propagated to other search heads).

A revision history is maintained for lookups so that you can view or restore older lookups easily in the interface.


This app needs no configuration, just install it via the Splunk Manager:

  1. Log in to Splunk and go to Apps > Manage Apps.
  2. Click install app from file.
  3. Upload the app package file and click upload

More Information

This project is open source. See GitHub for the source or for more information.

Release Notes

Version 2.7.1
Sept. 4, 2017

Fixing issue where lookups with spaces in the names were allowed

Version 2.7.0
June 1, 2017

1) Importing CSV files into KV store lookups is now supported
2) KV store lookup files will be opened in the "nobody" owner context by default now
3) Fixed error message when deleting KV store row entries on Splunk 6.6
4) Edit ACLs page now opens in a new page

Version 2.6.2
May 20, 2017

1) CSV lookups with invalid characters can now be loaded
2) Added the search views to the navigation

Version 2.6.1
May 6, 2017

1) Improving styling on Splunk 6.6
2) Fixing refresh button on the lookup editor page which didn't work in some cases

Version 2.6.0
March 26, 2017

1) Added ability to refresh the lookup
2) Added link to edit lookup permissions from the list page
3) Fixed misaligned dropdown on the lookup list page
4) Improved the list of users on the KV lookup editor to make it easier to use when lots of users exist
5) Updated the icon

Version 2.5.0
Nov. 10, 2016

1) KV store lookups can now be disabled and enabled
2) Fixed issue where a user-made lookup file that had it's permissions set to shared could not be opened
3) Improved the styling of the lookups list page
4) Fixed incompatibilty with the Mobile Access Add-on

Version 2.4.0
Oct. 15, 2016

1) Added link to open lookups in search
2) Fixed issue where a KV store lookup with missing fields might cause the rows to not line up with the header

Version 2.3.4
Oct. 12, 2016

Fixed issue where the app could cause Splunk to make world writable files

Version 2.3.3
Sept. 30, 2016

* Fixed issue where KV store lookups with boolean values didn't work on some versions of Splunk
* Added support for Splunk 6.5
* Fixed issue where you couldn't delete the first row on KV store lookups

Version 2.3.2
Sept. 13, 2016

* Added ability to edit blank CSV files
* Editor now works even if ES is installed
* JSON blobs within columns can now be edited

Version 2.3.1
July 13, 2016

Fixed some issues on the lookup creation page

Version 2.3
July 7, 2016

* Updated the table editor (various bug fixes)
* Adding validation of numeric cells in KV lookups
* Adding validation of time cells in KV lookups
* Time values are now properly converted to epoch-seconds (a number) when being saved
* Table is now re-rendered properly when switching user contexts
* User interface improvements to the editor
* Added export option to the editor

Version 2.2
June 20, 2016

* Added ability to load KV store collections entries from other users
* Fixed issue where the first row of KV store lookups could not be removed
* Updated icon

Version 2.1.2
April 26, 2016

Press CTRL + E on the lookup edit page for a blast from the past!

Version 2.1.1
Feb. 19, 2016

Fixed issue where some lookups would not appear in the list

Version 2.1.0
Feb. 10, 2016

New features:
* Added ability to make a user-specific lookup
* Added ability to filter for user-specific lookups on the lookups list

Bugs fixes:
* Updated the description of CSV lookups to note that CSV lookups do support SHC
* Fixed an issue where a value of "null" would appear in the editor sometimes
* Fixed an issue where the UI would not let you change the lookup name if new lookup creation failed * Added sourcetyping of the lookup editor controller logs
* App now detects if you are using an older version of Splunk that doesn't support KV store and hides KV options
* The editor no longer allows you to select a disabled app
* The lookups list now includes the ability to filter on apps that only include KV lookups

Version 2.0.3
Dec. 4, 2015

* Fixing compatibility issue with IE 11
* Adding text to make it clear that KV store lookups will be automatically saved
* Fixing issue where the renderer was not styling the cells correctly

Version 2.0.2
Nov. 29, 2015

Eliminating XSS issue on file import

Version 2.0.1
Nov. 26, 2015

Fix for XSS issue in HandsOnTable

Version 2.0.0
Nov. 19, 2015

Complete re-write, changes include:
* Support for KV store lookups
* Refreshed UI
* Dropped Splunk 5.0 support
* CSV lookups are now replicated (SHC support)

Version 1.4.1
Feb. 1, 2015

* Fixed issue where some lookup files could not be loaded in some cases
* Fixed minor Javascript error that occurred if the server indicated that the lookup file couldn't be saved
* Backup file times now represent the date that the file was modified (not the date it was backed up)

Version 1.4.0
Nov. 15, 2014

Added ability to import CSV files in the editor

Version 1.3.1
Nov. 10, 2014

Updating icon for Splunk 6.2

Version 1.3
Sept. 9, 2014

Added support for backups of lookup files and ability to load a previous version

Version 1.2
June 25, 2014

Added ability to select how many entries to show on each page

Version 1.1
May 23, 2014

* Added warning when users attempt to delete the header row
* Made the header row sticky such that it stays at the top of the page even when you scroll down

Version 1.0
May 10, 2014

* Fixed issue whee the button to create a new lookup file could not be clicked on Splunk 6.1
* Fixed issue that caused the lookup editor is fail on Splunk hosts using a custom root endpoint

Version 0.7
March 4, 2014

Fixed issue where the header and footer did not show on 6.0 due to a Javascript error

Version 0.6
March 1, 2014

Added compatibility with Splunk 5.0 and added limit for very large lookup files (prevents the browser from crashing when attempting to save lookup files over 10 MB)

Version 0.5
Feb. 21, 2014

Early beta version of the lookup editor. Doesn't yet work on Splunk 5.0.* (but should soon).


Subscribe Share

Splunk Certification Program

Splunk's App Certification program uses a specific set of criteria to evaluate the level of quality, usability and security your app offers to its users. In addition, we evaluate the documentation and support you offer to your app's users.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2018 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.