Help for retrieving a lookup date and to display it in a dashboard

[jip31]

hi

I have a csv file in my lookup folder (host.csv) and I wonder if its possible to retrieve the last modification file of this file and to display it in a panle title?
thanks for your help

[woodcock]

If by last modification you mean the current state, then yes, just do this:

| inputlookup YourLookupFileNameHere.csv

If you mean the previous state before the last edit, then this is only possible if you have taken steps to save it before you edit it, or if you are using Lookup File Editor app. If the latter, then there is a Revert to previous version button that allows this.

[arjunpkishore5 · Accepted solution]

Not very clear on what exactly you meant by "last modification file".

If you meant just display the latest version for the file, do this

| inputlookup <filename>.csv

If you want the last modified timestamp of the file, use the rest api, use this

| rest /servicesNS/-/-/data/lookup-table-files/<filename>.csv 
| table updated

[nehamvinchankar]

Can you use above rest query for kv store lookup also?

[jip31]

Hi
I want to retrieve the last modification date like when you do "right click" and "properties" on a file
I dont understand your answer
what do you mean by "| inputlookup .csv"??

[arjunpkishore5]

Please mark as answer if this answers your query

[jip31]

hello
The API works but how to format the updated field??
| rest/servicesNS/-/-/data/lookup-table-files/host.csv
| eval updated = strftime(updated, "%d-%m-%y %H:%M")
| table updated

[arjunpkishore5]

| eval updated=strptime(updated,"%FT%T%:z")

strftime converts unix timestamp(number) to string
strptime converts string to unix timestamp

[jip31]

hummm, issue, there is no results when I add your eval...

[arjunpkishore5]

I would guess the time format is different in your Splunk setup. Can you post a sample time without the eval?

[jip31]

here is
1970-01-01T01:00:00+01:00

[arjunpkishore5]

The earliest data strptime can work with is January 1 1971. Try using a more recent date.
https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/DateandTimeFunctions

[arjunpkishore5]

Inputlookup displays the contents of your csv file in a table.

For your use case, use the rest command I pasted in the answer