https://community.splunk.com/t5/Splunk-Search/lookup-file-no-longer-being-updated-how-to-identify-how-it-was/m-p/405022#M117103 <P>A splunk user has identified that a lookup table has not been updated for some time. </P> <P>I was previously unaware of this lookup table as it had been created by someone else who no longer works on the system. I would like to investigate what script / report etc has generated and updated the lookup report previously, but I don't know where to start looking.</P> <P>can anyone help guide me please with perhaps any queries or file searches that might be useful to identify what created the lookup file, and better still, what process/scrip/report was updating the lookup file?</P> <P>thanks</P> Thu, 11 Apr 2019 06:37:17 GMT vincenp2 2019-04-11T06:37:17Z https://community.splunk.com/t5/Splunk-Search/lookup-file-no-longer-being-updated-how-to-identify-how-it-was/m-p/405022#M117103 <P>A splunk user has identified that a lookup table has not been updated for some time. </P> <P>I was previously unaware of this lookup table as it had been created by someone else who no longer works on the system. I would like to investigate what script / report etc has generated and updated the lookup report previously, but I don't know where to start looking.</P> <P>can anyone help guide me please with perhaps any queries or file searches that might be useful to identify what created the lookup file, and better still, what process/scrip/report was updating the lookup file?</P> <P>thanks</P> Thu, 11 Apr 2019 06:37:17 GMT https://community.splunk.com/t5/Splunk-Search/lookup-file-no-longer-being-updated-how-to-identify-how-it-was/m-p/405022#M117103 vincenp2 2019-04-11T06:37:17Z https://community.splunk.com/t5/Splunk-Search/lookup-file-no-longer-being-updated-how-to-identify-how-it-was/m-p/405023#M117104 <P>Searching the _internal logs for the lookup name might give some clues (if those go back far enough).</P> <P>For finding how it got updated, that would likely be a saved search, so if you have file system access on your search head(s), you could scan for savedsearches.conf files and in those search for the lookup name.</P> Thu, 11 Apr 2019 07:08:15 GMT https://community.splunk.com/t5/Splunk-Search/lookup-file-no-longer-being-updated-how-to-identify-how-it-was/m-p/405023#M117104 FrankVl 2019-04-11T07:08:15Z https://community.splunk.com/t5/Splunk-Search/lookup-file-no-longer-being-updated-how-to-identify-how-it-was/m-p/405024#M117105 <P>brilliant! many thanks, a trawl of savedsearches.conf has given me the info I need </P> Thu, 11 Apr 2019 08:13:58 GMT https://community.splunk.com/t5/Splunk-Search/lookup-file-no-longer-being-updated-how-to-identify-how-it-was/m-p/405024#M117105 vincenp2 2019-04-11T08:13:58Z