Splunk Search

How to write a search that will determine if a lookup file has been updated?

splunkrocks2014
Communicator

How to write a search that will determine if a lookup file has been updated?

Thanks.

0 Karma
1 Solution

DMohn
Motivator

Assuming you have a search that updates your lookup file, the easiest way would be to add another field last_update to your lookup entries. This way you can always tell when the respective entry has been last updated.

View solution in original post

0 Karma

DMohn
Motivator

Assuming you have a search that updates your lookup file, the easiest way would be to add another field last_update to your lookup entries. This way you can always tell when the respective entry has been last updated.

0 Karma

splunkrocks2014
Communicator

The lookup file has the "Last_Updated" field, but it has different timestamps associated with each record. Also, the lookup file is uploaded by the end-users.

0 Karma

DMohn
Motivator

You can still load the lookup file and check for the latest "last_updated" field.
As far as I know there is no built-in possibility to check for a file update.

0 Karma

splunkrocks2014
Communicator

Thanks DMohn

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...