topic Re: Lookup creation validation in Splunk Enterprise

Lookup creation validation

rayar — Thu, 08 Apr 2021 14:09:54 GMT

we are running 2 steps progress

1. Create lookup (by scheduled report )

2. Create index summary using the lookup data

what will be the best way to make sure the step 2 starts only incase step 1 is completed successfully ?

Re: Lookup creation validation

aasabatini — Thu, 08 Apr 2021 14:26:28 GMT

Hi @rayar

you can check the triggered report or alert with this search:

after you ran this search you can create alert action to run another search to collect the results.
this is just one method but I think you can use a lot of use case.

Re: Lookup creation validation

rayar — Sun, 11 Apr 2021 08:47:55 GMT

The first step is to build the lookup we are running it as a report , how we can verify that the lookup builder is completed ?

the query is running for alerts only

Re: Lookup creation validation

aasabatini — Mon, 12 Apr 2021 15:19:09 GMT

Hi @rayar

please use these info to build your search, any search are stored on _audit index.
please add on this search these details to understand if is completed

index=_audit action=search info=completed user=[owner of the search] savedsearch_name=[the name of the search]

please remember to add values on user field and savedsearch_name field

Re: Lookup creation validation

rayar — Tue, 13 Apr 2021 06:27:15 GMT

I see that even those that failed and weren't fully completed are marked as completed

Re: Lookup creation validation

aasabatini — Tue, 13 Apr 2021 10:57:54 GMT

Hi @rayar,

apologize for the multiple answer but without see the data it's little bit hard.

are you identified the saved search on audit log?

also to show your saved search you can use this search

| rest splunk_server=local /services/saved/searches | rename eai:acl.owner AS Author eai:acl.sharing AS Permissions eai:acl.app AS App search AS "Saved Search" | fields Author Permissions App "Saved Search"

let me know