Splunk Search

lookup file no longer being updated - how to identify how it was being updated

vincenp2
New Member

A splunk user has identified that a lookup table has not been updated for some time.

I was previously unaware of this lookup table as it had been created by someone else who no longer works on the system. I would like to investigate what script / report etc has generated and updated the lookup report previously, but I don't know where to start looking.

can anyone help guide me please with perhaps any queries or file searches that might be useful to identify what created the lookup file, and better still, what process/scrip/report was updating the lookup file?

thanks

0 Karma
1 Solution

FrankVl
Ultra Champion

Searching the _internal logs for the lookup name might give some clues (if those go back far enough).

For finding how it got updated, that would likely be a saved search, so if you have file system access on your search head(s), you could scan for savedsearches.conf files and in those search for the lookup name.

View solution in original post

0 Karma

FrankVl
Ultra Champion

Searching the _internal logs for the lookup name might give some clues (if those go back far enough).

For finding how it got updated, that would likely be a saved search, so if you have file system access on your search head(s), you could scan for savedsearches.conf files and in those search for the lookup name.

0 Karma

vincenp2
New Member

brilliant! many thanks, a trawl of savedsearches.conf has given me the info I need

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...