【重要】Splunk 的 Lookup Table能否被覆盖呢？

1: 背景：

用户自己的lookup table 可能需要被覆盖，因为用户自己会自动更新，但是如果不是用户自己更新，Deployer 上面发布的时候，用于没有用户的table ，那么默认是不能把客户的table overwite 的。如果用户要覆盖的话，如果客户有权限的话，客户可以自己更换lookup table.

2: 原理：

Preserve lookup files across app upgrades

Any app that uses lookup tables typically ships with stubs for the table files. Once the app is in use on the search head the tables get populated by runtime processes, such as searches. When you later upgrade the app, you can choose to preserve the populated lookup tables or overwrite them with stubs.

Set the deployer_lookups_push_mode in app.conf to specify how the deployer handles lookup tables when upgrading apps. This setting determines the behavior of the -preserve-lookups option when you push the configuration bundle using the splunk apply shcluster-bundle command.

1. Choose