Getting Data In

Is there a way to tell what is populating a LOOKUP csv file?

Gregski11
Contributor

I inherited a Splunk environment I was informed the other day that a computers.csv lookup is not generating any results, is there a way to find out what should be populating that file which is currently empty, I did find the App which houses the lookup csv 

Labels (1)
0 Karma

Gregski11
Contributor

I ranned this and found some clues

 

 

| rest splunk_server=local /servicesNS/-/-/saved/searches
| table title eai:acl.app eai:acl.owner search
| where match(search,"computers.csv")

richgalloway
SplunkTrust
SplunkTrust

Search your saved searches for the name of the lookup file.

 

| rest /servicesNS/-/-/saved/searches splunk_server=local
| search search="*computers.csv*" search="*outputlookup*"
| table title

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Gregski11
Contributor

thanks Rich I ran those searches in two separate Splunk environments (the lookup is working in one but not in the other) and got this error in both:

No results found. Try expanding the time range.

 

even after expanding the time range to 30 days I get nothing, plus I don't understand what you are having me do, could you explain please 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I left out some key wildcards.  I've updated my answer.

Like I said in the answer, the query searches your saved searches, reports, and alerts (all the same thing, really) for references to the lookup file.  It also searches for the outputlookup command to help narrow the scope to those searches that write to the lookup.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...