icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

Thank You

Downloading Splunk App for Lookup File Editing
SHA256 checksum (splunk-app-for-lookup-file-editing_360.tgz) 474ca7a7368a16a4d310c4f8b64b5bebc487df31d13714060ca8ee589fbd7e74 SHA256 checksum (splunk-app-for-lookup-file-editing_350.tgz) 2f6095578a8b59c813696fff1bbae4813e7053d153654e2cc4bec98470f343b1 SHA256 checksum (splunk-app-for-lookup-file-editing_346.tgz) abd0d9f10dbcc149d075d932f99f33acc25461759a79c32f9d7d0b777730c0eb SHA256 checksum (splunk-app-for-lookup-file-editing_345.tgz) 4944d2b885e0746e8a9f4cba07ab0247972bd2d52093f4ff50de1e699478b059 SHA256 checksum (splunk-app-for-lookup-file-editing_344.tgz) d893d5b8c53576db3fcc8bbd160e33b1b0db80619dc35449fba37966574ebbe5 SHA256 checksum (splunk-app-for-lookup-file-editing_343.tgz) 03f7ea0d82888e2c30bf46fc84f9f731e145532d6f86cc4bdf2ab6b5401feba8 SHA256 checksum (splunk-app-for-lookup-file-editing_342.tgz) e6a38e01cef0659c5bbe09f810ffa25ecec45dd82a8f486919d014e582d72c96 SHA256 checksum (splunk-app-for-lookup-file-editing_341.tgz) eae0fb3521d8a911430f436caf55c19d5a928894c60d4335aa860b88f1b2076b SHA256 checksum (splunk-app-for-lookup-file-editing_340.tgz) 851109044069eaf3305e4cfe6ce3680f5b8a0945e37f636294d6c6d93f7dc477 SHA256 checksum (splunk-app-for-lookup-file-editing_333.tgz) b415c072cf3fc1062a7c3bdeecd22ffb94309e5c788e28d3cf5cd2d47e59c148 SHA256 checksum (splunk-app-for-lookup-file-editing_332.tgz) 4ab2748963491e2405fc7a296de88910f77d2329727ce7af06aa2d594939671d SHA256 checksum (splunk-app-for-lookup-file-editing_331.tgz) f48a0682540294f50e944364da0718ac038c4f73c6a02862ab80cdfa2fefcf12 SHA256 checksum (splunk-app-for-lookup-file-editing_33.tgz) 0a2724bd5251f1e3211514cb9ef700ff1102f60859b168dbc89ec90c64931b66 SHA256 checksum (splunk-app-for-lookup-file-editing_321.tgz) 8ac2b1f5598d3457a6539b1f197239c500b73fee9d9a5977a0b91ff907740dc8 SHA256 checksum (splunk-app-for-lookup-file-editing_320.tgz) eb3cff612a6d38de6de27f95ba5e05aaa0047a3d450253a44cddcdead69269e3 SHA256 checksum (splunk-app-for-lookup-file-editing_310.tgz) f2b25249993d2c6cb39152ccbb4b2f3041ed59ab3817e52525635457917d9861 SHA256 checksum (splunk-app-for-lookup-file-editing_305.tgz) 4bbad7066779ecc52401e31172977e42cb9be4fbab6bd1025f8753bf0b34b97d SHA256 checksum (splunk-app-for-lookup-file-editing_304.tgz) b4875dc1c64c320fe842232eeec6f844dd8c4d3b5926eeef466baf4adf156a00 SHA256 checksum (splunk-app-for-lookup-file-editing_303.tgz) dd0e23b3472942f44b93db0a29b1ae9e6c6b80e6bb7bbc1dc991e0e44d1255fe SHA256 checksum (splunk-app-for-lookup-file-editing_302.tgz) 8a0c07ef4eff834d12ca107657f26a977691bcbba63f529b20593af4c83eddc5 SHA256 checksum (splunk-app-for-lookup-file-editing_301.tgz) 03eb29df7dba9f6674ec04c03e3171abce3bb3fdcb8aeae0cc8b217f793b6cb4 SHA256 checksum (splunk-app-for-lookup-file-editing_300.tgz) 42db43770c00859578bba98a8b1803cfa042750661bf61a26e532c9e00fa460e SHA256 checksum (splunk-app-for-lookup-file-editing_271.tgz) 3d1b70c6c4c473c1e95900d33f39552148b17954023ecb4f8c7343beed270ff6 SHA256 checksum (splunk-app-for-lookup-file-editing_270.tgz) 911a10778d4f218952ccbb1ef74bdbd6e97ccffe424e9719cd7089688db6d491 SHA256 checksum (splunk-app-for-lookup-file-editing_262.tgz) e038f61c2b10b4f054ccc885327d9963059037334e1f7f12a354c3ef7ea5dddb SHA256 checksum (splunk-app-for-lookup-file-editing_261.tgz) dd3761108e380c68689696494be630c0bf1abc74045427b3256a87421e40d2e0 SHA256 checksum (splunk-app-for-lookup-file-editing_260.tgz) 14a9f1b4be6fc08deffc4bd8829390915889c85b445a48e5e30ffdb27aef630d SHA256 checksum (splunk-app-for-lookup-file-editing_250.tgz) 092870226628c3104966df08fbaa31a8e57e55aeea7b233e80596d401fe5c8ee SHA256 checksum (splunk-app-for-lookup-file-editing_240.tgz) 59c28f33727a709960203abcbb7c966fff1e3dff57889cb91628c14c5f1bda04 SHA256 checksum (splunk-app-for-lookup-file-editing_234.tgz) 0cef4c62b288da6965f4a6e5f1588df8d9f605a423aded8d931dfeb407841f59 SHA256 checksum (splunk-app-for-lookup-file-editing_233.tgz) 4990d8711ff1b1b9a4141d39f7821aeaa19d0cedaaf6db7bb90d0cebe5df1fd8 SHA256 checksum (splunk-app-for-lookup-file-editing_232.tgz) b245097e9c532dc5bf334e02301814d7bebe13c06e24b0a28a97db435e16ccae SHA256 checksum (splunk-app-for-lookup-file-editing_231.tgz) 42f3244fa7fb44d14524ebcf39b2d180124a9f771b4b94b50791755603f709d6 SHA256 checksum (splunk-app-for-lookup-file-editing_23.tgz) 3faa910f54453d121ab097abd0f878effc7e1f3fb113acfba399232a87444e9b SHA256 checksum (splunk-app-for-lookup-file-editing_22.tgz) 648da3abbe7379cfed229cf24ef9a8d1171b07312e9eea3e45c4fa7ef98d258b SHA256 checksum (splunk-app-for-lookup-file-editing_212.tgz) 671e87fa1c35092ea7838082587f0e8e59aa088f77bf0d13914cea1e066c9bba SHA256 checksum (splunk-app-for-lookup-file-editing_211.tgz) 1316d3ec2ad6f427ffbf1e78cf7dd63c5b46cd7bdee02c0a8f947c7089e241b4 SHA256 checksum (splunk-app-for-lookup-file-editing_210.tgz) c9f1b4d8e959314377ae823689cf46031a1d1a0da7625ac6ec8ff01153c054c3 SHA256 checksum (splunk-app-for-lookup-file-editing_203.tgz) cb88ffd9ade27b9a0c3e7bbbe72ca997bf027db3650e2ce077fcb1e8a16ea377 SHA256 checksum (splunk-app-for-lookup-file-editing_202.tgz) e5a313f8e945f7b2cca8aed507feb887e35e1634d87a8c818e586dd61435bef6 SHA256 checksum (splunk-app-for-lookup-file-editing_201.tgz) 09390676623c3ccb95dd24c123c608a8d3436e6376758a86508cd0ab0d619b22 SHA256 checksum (splunk-app-for-lookup-file-editing_200.tgz) 512e98f895dc7ce82c4194c84d10609af0b3c8c8cd6f8cfab43252296df5694b
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Splunk App for Lookup File Editing

Splunk Cloud
Splunk Built
Ever want to edit a lookup within Splunk with a user interface? Now you can. This app provides an Excel-like interface for editing, importing, and exporting lookup files (KV store and CSV-based).

This app also makes your lookups work in Search Head Clustered environments (edits to lookups will be propagated to other search heads).

Revision history is maintained for lookups so that you can view or restore older lookups quickly in the interface.

Check out the Documentation site:

Release Notes

Version 3.6.0
May 5, 2022
Version 3.5.0
June 29, 2021

Adding support for jQuery 3 (and therefore support for newer versions of Splunk)

Version 3.4.6
July 17, 2020

1) Fixed XSS issue caused by older versions of third party libraries
2) Updated jexcel and jsuite libraries

Version 3.4.5
July 15, 2020

1) Fixed issue where you imports only worked for the few columns
2) Added a horizontal scrollbar

Version 3.4.4
June 25, 2020

Adding changes to address appinspect problems

Version 3.4.3
June 23, 2020

Added app manifest to indicate that the app only needs to be installed on the search head

Version 3.4.2
June 9, 2020

1) Fixing issue where an cell entry that was in the process of being edited was not saved
2) Making replication blacklist include the files with the ".default" extension.

Version 3.4.1
April 23, 2020

Fixed issue where values with some characters (such as "<" and ">") failed to appear

Version 3.4.0
April 14, 2020
  1. Added ability to search entries in the editor
  2. New KV store rows are no longer saved until the user sets a field
  3. Column name changes are done through a context menu which should make column renaming easier
  4. Replaced the handsontable library with jexcel
Version 3.3.3
Nov. 15, 2019

Adding Python 3 support

Version 3.3.2
June 27, 2019

1) Fixed issue where filtering on the lookup list didn't work correctly in some cases
2) Lookups can now be created when using the free license

Version 3.3.1
May 6, 2019

Fixed error when attempting to edit KV store lookup file

Version 3.3
May 2, 2019

1) Added support for CIDR and array KV store field types |
2) Fixed issue where time values in KV store lookups were being converted incorrectly

Version 3.2.1
March 8, 2019

Fixed issue where time values were not converted correctly

Version 3.2.0
Feb. 25, 2019

Replication of KV store collections is now optional; the editor gives you the option to disable replication

Version 3.1.0
Feb. 13, 2019

Numerous improvements to the editor (sorting support, bug fixes, etc.)

Version 3.0.5
Nov. 20, 2018

Lookup backup files are no longer replicated to the indexers (reduces bundle sizes)

Version 3.0.4
June 21, 2018

1) Fixing issue where app was incompatible with apps that had copied components from the Lookup Editor
2) Fixing issue where transform entry was made incorrectly for KV store lookups with a field name containing a space

Version 3.0.3
June 3, 2018

1) Fixing issue where time fields could be mis-interpreting and saved as "NaN"
2) Fixing double encoding issue causing lookups files to not be listed
3) Fixing issue where lookups that were user-owned by a user with a slash couldn't be loaded or deleted
4) New CSV lookup files are no longer created via direct access
5) Lookup creation was disallowed unnecessarily for CSVs for non-admins

Version 3.0.2
May 22, 2018

1) Fixing issue where lookup saving would be considered a failure when replication could not be forced
2) Added message noting that lookup file is being loaded
3) KV store lookup fields are correctly loaded when the fields are declared in transforms.conf

Version 3.0.1
May 14, 2018

1) Fixing issue where CSVs didn't loaded for some user names (such as those with slashes)
2) Fixing broken open-in-search link

Version 3.0.0
April 27, 2018

1) Added support for Splunk 7.1
2) Numerous user interface enhancements
3) Added ability to replicate lookup backup files in a Search Head Cluster (see https://lukemurphey.net/projects/splunk-lookup-editor/wiki/FAQ for how to enable it)
4) Added a link to open a lookup in search from the lookup editor
5) Added a dialog that will guide the user in creating a lookup transform in order to open it in search
6) Added support for editing on an iPad

Version 2.7.1
Sept. 4, 2017

Fixing issue where lookups with spaces in the names were allowed

Version 2.7.0
June 1, 2017

1) Importing CSV files into KV store lookups is now supported
2) KV store lookup files will be opened in the "nobody" owner context by default now
3) Fixed error message when deleting KV store row entries on Splunk 6.6
4) Edit ACLs page now opens in a new page

Version 2.6.2
May 20, 2017

1) CSV lookups with invalid characters can now be loaded
2) Added the search views to the navigation

Version 2.6.1
May 6, 2017

1) Improving styling on Splunk 6.6
2) Fixing refresh button on the lookup editor page which didn't work in some cases

Version 2.6.0
March 26, 2017

1) Added ability to refresh the lookup
2) Added link to edit lookup permissions from the list page
3) Fixed misaligned dropdown on the lookup list page
4) Improved the list of users on the KV lookup editor to make it easier to use when lots of users exist
5) Updated the icon

Version 2.5.0
Nov. 10, 2016

1) KV store lookups can now be disabled and enabled
2) Fixed issue where a user-made lookup file that had it's permissions set to shared could not be opened
3) Improved the styling of the lookups list page
4) Fixed incompatibilty with the Mobile Access Add-on

Version 2.4.0
Oct. 15, 2016

1) Added link to open lookups in search
2) Fixed issue where a KV store lookup with missing fields might cause the rows to not line up with the header

Version 2.3.4
Oct. 12, 2016

Fixed issue where the app could cause Splunk to make world writable files

Version 2.3.3
Sept. 30, 2016
  • Fixed issue where KV store lookups with boolean values didn't work on some versions of Splunk
  • Added support for Splunk 6.5
  • Fixed issue where you couldn't delete the first row on KV store lookups
Version 2.3.2
Sept. 13, 2016
  • Added ability to edit blank CSV files
  • Editor now works even if ES is installed
  • JSON blobs within columns can now be edited
Version 2.3.1
July 13, 2016

Fixed some issues on the lookup creation page

Version 2.3
July 7, 2016
  • Updated the table editor (various bug fixes)
  • Adding validation of numeric cells in KV lookups
  • Adding validation of time cells in KV lookups
  • Time values are now properly converted to epoch-seconds (a number) when being saved
  • Table is now re-rendered properly when switching user contexts
  • User interface improvements to the editor
  • Added export option to the editor
Version 2.2
June 20, 2016
  • Added ability to load KV store collections entries from other users
  • Fixed issue where the first row of KV store lookups could not be removed
  • Updated icon
Version 2.1.2
April 26, 2016

Press CTRL + E on the lookup edit page for a blast from the past!

Version 2.1.1
Feb. 19, 2016

Fixed issue where some lookups would not appear in the list

Version 2.1.0
Feb. 10, 2016

New features:
Added ability to make a user-specific lookup
Added ability to filter for user-specific lookups on the lookups list

Bugs fixes:
Updated the description of CSV lookups to note that CSV lookups do support SHC
Fixed an issue where a value of "null" would appear in the editor sometimes
Fixed an issue where the UI would not let you change the lookup name if new lookup creation failed * Added sourcetyping of the lookup editor controller logs
App now detects if you are using an older version of Splunk that doesn't support KV store and hides KV options
The editor no longer allows you to select a disabled app
The lookups list now includes the ability to filter on apps that only include KV lookups

Version 2.0.3
Dec. 4, 2015
  • Fixing compatibility issue with IE 11
  • Adding text to make it clear that KV store lookups will be automatically saved
  • Fixing issue where the renderer was not styling the cells correctly
Version 2.0.2
Nov. 29, 2015

Eliminating XSS issue on file import

Version 2.0.1
Nov. 26, 2015

Fix for XSS issue in HandsOnTable

Version 2.0.0
Nov. 19, 2015

Complete re-write, changes include:
* Support for KV store lookups
* Refreshed UI
* Dropped Splunk 5.0 support
* CSV lookups are now replicated (SHC support)

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.