Knowledge Management

When a lookup is updated via | outputlookup, does that change the modified time?

harishsplunk7
Explorer

When a lookup is updated via | outputlookup, does that change the modified time? 
For example - search for a lookup or kvstore name and see the SPL that gives overall usage, then have the option to filter to only those SPL searches that have an outputlookup that modify the file.

index=abc sourcetype=xyz | stats count | outputlookup append=true newlookup.csv

How can i track whether outputlokkup file is updated or not using _internal or _audit index. Pleae suggest the splunk query to get the status 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Let me try to answer two separate questions.  I think the question about "modified time" is in regard to file system record.  Is this correct?  Yes, file system modified time is updated.

Splunk 9 added a Update: If you install Chris Younger's Config Explorer, you will find sourcetype config_explorer in _internal that includes the information you want.  For example, you can do

 

index = _internal sourcetype="config_explorer" item="./etc/*/lookups/*"
| stats max(_time) as _time by item

 

I don't think such information is retained before 9 without an app.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...