Automates the lifecycle of Splunk CSV lookup files and table definitions via the REST API.
The Splunk Lookup skill empowers Claude to manage data enrichment tables directly within your Splunk environment, streamlining the process of uploading, downloading, and listing CSV lookup files. It handles the creation of necessary lookup-table stanzas (definitions) required for data correlation, making it an essential tool for security analysts and Splunk administrators who need to update threat intelligence lists, user directories, or asset catalogs without manually navigating the Splunk Web UI. By leveraging the Splunk REST API, this skill provides a production-ready framework for maintaining critical enrichment data with high efficiency.
Key Features
01Securely delete obsolete lookup files via programmatic commands
020 GitHub stars
03Download existing lookup tables for local editing or backup
04Automate the creation of lookup-table stanzas and definitions
05List and inspect metadata for all lookups within a target app
06Upload and overwrite CSV lookup files to specific Splunk apps
Use Cases
01Updating threat intelligence or IOC lists in real-time for security monitoring
02Synchronizing user identity data or asset inventory for log enrichment
03Automating the migration of lookup tables between development and production environments
