Getting Data In

Is there a way to tell what is populating a LOOKUP csv file?

Gregski11
Contributor

I inherited a Splunk environment I was informed the other day that a computers.csv lookup is not generating any results, is there a way to find out what should be populating that file which is currently empty, I did find the App which houses the lookup csv 

Labels (1)
0 Karma

Gregski11
Contributor

I ranned this and found some clues

 

 

| rest splunk_server=local /servicesNS/-/-/saved/searches
| table title eai:acl.app eai:acl.owner search
| where match(search,"computers.csv")

richgalloway
SplunkTrust
SplunkTrust

Search your saved searches for the name of the lookup file.

 

| rest /servicesNS/-/-/saved/searches splunk_server=local
| search search="*computers.csv*" search="*outputlookup*"
| table title

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Gregski11
Contributor

thanks Rich I ran those searches in two separate Splunk environments (the lookup is working in one but not in the other) and got this error in both:

No results found. Try expanding the time range.

 

even after expanding the time range to 30 days I get nothing, plus I don't understand what you are having me do, could you explain please 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I left out some key wildcards.  I've updated my answer.

Like I said in the answer, the query searches your saved searches, reports, and alerts (all the same thing, really) for references to the lookup file.  It also searches for the outputlookup command to help narrow the scope to those searches that write to the lookup.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...