topic Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups in Getting Data In

Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

mcm10285 — Thu, 01 Aug 2013 04:01:07 GMT

Does splunk read $SPLUNKHOME/etc/apps/search/lookups in a special manner? I placed a csv file in that directory of a search head to be monitored and it seems like it is not being indexed, or at least it's not searchable. Using it as an inputlookup works though. I want to monitor that file and use it in a form search, an inventory search.

Checked /var/log/splunk/splunkd.log, below is the only log found on the directory/path where the file is:

INFO TailingProcessor - Parsing configuration stanza: monitor:///splunksearches/SH/etc/apps/search/lookups/filename.csv

INFO TailingProcessor - Adding watch on path:///splunksearches/SH/etc/apps/search/lookups/filename.csv

Re: Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

martin_mueller — Thu, 01 Aug 2013 06:34:35 GMT

Why would you index a lookup? If you want to start searches with that data, just use inputlookup.

Re: Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

mcm10285 — Thu, 01 Aug 2013 08:44:48 GMT

I don't. I just placed a file in the lookups folder and I want to index that.

Input lookup needs a search against it. I need to search on the file itself.

Re: Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

martin_mueller — Thu, 01 Aug 2013 11:00:04 GMT

Start your search with inputlookup, that'll give you the file in Splunk to continue your search:

| inputlookup file_name | search something or other

Re: Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

lukejadamec — Thu, 01 Aug 2013 13:30:21 GMT

Using tail for a one time file index routine is not the best way to go about it.
Try it from the commandline - see this post
splunk-base.splunk.com/answers/6922/how-to-ask-splunk-to-index-a-file-using-the-cli

Re: Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

mcm10285 — Fri, 02 Aug 2013 03:09:37 GMT

tried the CLI and returned the message below

In handler 'monitor': Cannot create another input with the name "/splunksearches/SH/etc/apps/search/lookups/IP_Blocklist.csv", one already exists.

However, when I checked, the data is already indexed. Wonder how long it took.

Thanks for the suggestions anyway.

Re: Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

mcm10285 — Wed, 11 Sep 2013 06:32:59 GMT

somewhow this just worked..might have been a delayed indexing...