topic Timestamp for values in a lookup table in Splunk Search

Timestamp for values in a lookup table

kiranpatil1985 — Thu, 02 May 2019 19:43:07 GMT

Is there any way I can find out when was a particular value entered into a Lookup table? My search query depends on the date values was created/entered in a lookup table.
Thanks in advance.

Re: Timestamp for values in a lookup table

somesoni2 — Thu, 02 May 2019 21:16:57 GMT

If your lookup table values doesn't contain the timestamp itself, you won't be able to know when an entry was entered. A lookup is a static csv file (assuming it's a file based lookup), and it has no historical reference to previous state.

Re: Timestamp for values in a lookup table

woodcock — Sat, 04 May 2019 20:09:33 GMT

Not unless it was included when the event was written. It is possible, though, that the _raw field was accidentally included in the file but you will not see it unless you do | rename _* AS invisible_* and if you have that, you can probably find the timestamp inside of the raw event.