topic How to pass calculate the latest row count in multiple lookups? in Splunk Search

How to pass calculate the latest row count in multiple lookups?

rajeshmetso — Thu, 21 Jul 2022 15:23:00 GMT

Hi All,

I have around 100+ lookups, which get updated daily from indexed data using macro and saved search. I want to find if any of these lookups are getting flushed and row count turns to "0". I created a lookup with all the lookup names and tried to pass the output to another lookup command and pull the stats. But this is not working.

Any suggestion to fullfil this requirement would be appreciated

Thanks

Rajesh

Re: How to pass calculate the latest row count in multiple lookups

ITWhisperer — Wed, 20 Jul 2022 11:00:06 GMT

It can get a bit complicated, but you could try something like this (assuming you have a lookup file with the names of the lookups in a field called file):

However, this can sometimes fail if you don't have a definition for the lookup, in which case, try it this way

Re: How to pass calculate the latest row count in multiple lookups

rajeshmetso — Wed, 20 Jul 2022 13:13:19 GMT

@ITWhisperer

Thank you for quick response. This sorted the issue, but am getting only 10 results and below warning.

The search result count (110) exceeds maximum (10), using max. To override it, set maxsearches appropriately.

Re: How to pass calculate the latest row count in multiple lookups

ITWhisperer — Wed, 20 Jul 2022 13:15:13 GMT

map - Splunk Documentation

Re: How to pass calculate the latest row count in multiple lookups

rajeshmetso — Wed, 20 Jul 2022 13:22:35 GMT

@ITWhisperer thank you it worked.