Splunk Search

How to write a search that will determine if a lookup file has been updated?

splunkrocks2014
Communicator

How to write a search that will determine if a lookup file has been updated?

Thanks.

0 Karma
1 Solution

DMohn
Motivator

Assuming you have a search that updates your lookup file, the easiest way would be to add another field last_update to your lookup entries. This way you can always tell when the respective entry has been last updated.

View solution in original post

0 Karma

DMohn
Motivator

Assuming you have a search that updates your lookup file, the easiest way would be to add another field last_update to your lookup entries. This way you can always tell when the respective entry has been last updated.

0 Karma

splunkrocks2014
Communicator

The lookup file has the "Last_Updated" field, but it has different timestamps associated with each record. Also, the lookup file is uploaded by the end-users.

0 Karma

DMohn
Motivator

You can still load the lookup file and check for the latest "last_updated" field.
As far as I know there is no built-in possibility to check for a file update.

0 Karma

splunkrocks2014
Communicator

Thanks DMohn

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...