Getting Data In

Is there a way to tell what is populating a LOOKUP csv file?

Gregski11
Contributor

I inherited a Splunk environment I was informed the other day that a computers.csv lookup is not generating any results, is there a way to find out what should be populating that file which is currently empty, I did find the App which houses the lookup csv 

Labels (1)
0 Karma

Gregski11
Contributor

I ranned this and found some clues

 

 

| rest splunk_server=local /servicesNS/-/-/saved/searches
| table title eai:acl.app eai:acl.owner search
| where match(search,"computers.csv")

richgalloway
SplunkTrust
SplunkTrust

Search your saved searches for the name of the lookup file.

 

| rest /servicesNS/-/-/saved/searches splunk_server=local
| search search="*computers.csv*" search="*outputlookup*"
| table title

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Gregski11
Contributor

thanks Rich I ran those searches in two separate Splunk environments (the lookup is working in one but not in the other) and got this error in both:

No results found. Try expanding the time range.

 

even after expanding the time range to 30 days I get nothing, plus I don't understand what you are having me do, could you explain please 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I left out some key wildcards.  I've updated my answer.

Like I said in the answer, the query searches your saved searches, reports, and alerts (all the same thing, really) for references to the lookup file.  It also searches for the outputlookup command to help narrow the scope to those searches that write to the lookup.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...