topic Help for retrieving a lookup date and to display it in a dashboard in Dashboards & Visualizations

Help for retrieving a lookup date and to display it in a dashboard

jip31 — Thu, 24 Oct 2019 11:21:31 GMT

I have a csv file in my lookup folder (host.csv) and I wonder if its possible to retrieve the last modification file of this file and to display it in a panle title?
thanks for your help

Re: Help for retrieving a lookup date and to display it in a dashboard

arjunpkishore5 — Thu, 24 Oct 2019 12:00:38 GMT

Not very clear on what exactly you meant by "last modification file".

If you meant just display the latest version for the file, do this

| inputlookup <filename>.csv

If you want the last modified timestamp of the file, use the rest api, use this

| rest /servicesNS/-/-/data/lookup-table-files/<filename>.csv 
| table updated

Re: Help for retrieving a lookup date and to display it in a dashboard

jip31 — Fri, 25 Oct 2019 11:28:32 GMT

Hi
I want to retrieve the last modification date like when you do "right click" and "properties" on a file
I dont understand your answer
what do you mean by "| inputlookup .csv"??

Re: Help for retrieving a lookup date and to display it in a dashboard

arjunpkishore5 — Fri, 25 Oct 2019 12:41:03 GMT

Inputlookup displays the contents of your csv file in a table.

For your use case, use the rest command I pasted in the answer

Re: Help for retrieving a lookup date and to display it in a dashboard

arjunpkishore5 — Fri, 25 Oct 2019 14:48:20 GMT

Please mark as answer if this answers your query

Re: Help for retrieving a lookup date and to display it in a dashboard

jip31 — Sun, 27 Oct 2019 14:28:39 GMT

hello
The API works but how to format the updated field??
| rest/servicesNS/-/-/data/lookup-table-files/host.csv
| eval updated = strftime(updated, "%d-%m-%y %H:%M")
| table updated

Re: Help for retrieving a lookup date and to display it in a dashboard

arjunpkishore5 — Mon, 28 Oct 2019 00:24:12 GMT

| eval updated=strptime(updated,"%FT%T%:z")

strftime converts unix timestamp(number) to string
strptime converts string to unix timestamp

Re: Help for retrieving a lookup date and to display it in a dashboard

woodcock — Mon, 28 Oct 2019 01:46:47 GMT

If by last modification you mean the current state, then yes, just do this:

| inputlookup YourLookupFileNameHere.csv

If you mean the previous state before the last edit, then this is only possible if you have taken steps to save it before you edit it, or if you are using Lookup File Editor app. If the latter, then there is a Revert to previous version button that allows this.

Re: Help for retrieving a lookup date and to display it in a dashboard

jip31 — Mon, 28 Oct 2019 06:20:06 GMT

hummm, issue, there is no results when I add your eval...

Re: Help for retrieving a lookup date and to display it in a dashboard

arjunpkishore5 — Mon, 28 Oct 2019 09:24:27 GMT

I would guess the time format is different in your Splunk setup. Can you post a sample time without the eval?

Re: Help for retrieving a lookup date and to display it in a dashboard

jip31 — Mon, 28 Oct 2019 09:26:22 GMT

here is
1970-01-01T01:00:00+01:00

Re: Help for retrieving a lookup date and to display it in a dashboard

arjunpkishore5 — Mon, 28 Oct 2019 10:47:49 GMT

The earliest data strptime can work with is January 1 1971. Try using a more recent date.
https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/DateandTimeFunctions

Re: Help for retrieving a lookup date and to display it in a dashboard

nehamvinchankar — Fri, 23 Feb 2024 09:59:10 GMT

Can you use above rest query for kv store lookup also?