topic Re: csv file usage in Splunk Search

csv file usage

shrinivaskittur — Tue, 28 Dec 2021 10:06:26 GMT

Hi,

I need help in evaluation the csv files under "<Splunk directory>\etc\apps\search\lookups" folder. we have multiple csv files in this folder and I need to check which csv file is not in use or used for which search so that unused csv file can be deleted.

Re: csv file usage

ITWhisperer — Tue, 28 Dec 2021 14:27:17 GMT

Can you not use file explorer and list the date accessed information?

Re: csv file usage

richgalloway — Tue, 28 Dec 2021 15:58:36 GMT

If you have access to the search head's file system then use grep to search $SPLUNK_HOME/etc/apps/*/local/savedsearches.conf and $SPLUNK_HOME/etc/apps/*/local/transforms.conf for instances of each CSV file name. Files not referenced are not used.

In case you missed a reference to a CSV, move it temporarily to a different directory so it can be replaced if later found to be needed.

Re: csv file usage

shrinivaskittur — Sun, 02 Jan 2022 08:49:31 GMT

thank you, but how do I check this on windows based search heads.

Re: csv file usage

richgalloway — Sun, 02 Jan 2022 14:29:30 GMT

I use Ubuntu for Windows. You also can use PowerShell

Select-string -Pattern "<text>" <filepattern> -Simplematch