- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Splunk is not displaying the latest time of lo...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk is not displaying the latest time of lookup updated
Splunk is not displaying the latest time of lookup updated
| rest /servicesNS/-/-/data/lookup-table-files
| search title=*
| table title updated
title updated
test.csv 1969-12-31T18:00:00-06:00
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Was this issue ever resolved? I am seeing the same issue in my SplunkCloud environment.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Definitely open a support case.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I suspect that the system clock on the host OS of your Search Head is borked or there is a Splunk bug somewhere. That says that the timestamp on the file is 0, which should not happen.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @woodcock, I do not see any issue with host OS. Not sure if it is a bug with Splunk, as a similar version of Splunk on the other SH is working fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@DMohn, lookup file was generated from outputlookup.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This time normally indicates, that the corresponding CSV hasn't been updated via Splunk at all. (It is the '0' UNIX timestamp value).
This interface will only show update times, if the lookup file is updates by means of Splunk (eg. outputlookup) - not if it is re-uploaded via the OS.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @ganji
check your user timezone
Harish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@harishalipaka, thanks for replying. User time zone is Default System Timezone and user timezone may not be the issue.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
