Splunk Enterprise

How to take a backup of lookup file?

sarahnazzar
Explorer

Hello Splunkers!

I'm trying to take a backup of a lookup file(file.csv) and create a backup file(file_backup.csv) and schedule the search on daily basis, the below query will only run and overwrite the old backup file but I want the scheduled search to run only when the new entries are added to the file.csv.

|inputlookup file.csv |outputlookup file_backup.csv

Also, I want to add 2 new columns (user who edited the lookup and time when it was edited) in the backup lookup 

Original file: file.csv

column1 column2 

Backup file file_backup.csv generated using the scheduled search should have the below 

column1 column2 time user 

Any thoughts please?

 

Cheers!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How do you know which user updated the file and when they did it?

0 Karma

sarahnazzar
Explorer

Tried pulling using the rest query but it doesn't give me what they have updated

|rest /servicesNS/-/-/data/lookup-table-files/

I want to have the user and time against the entry they have added in the lookup 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you have no control over the editing process, how are you going to determine who did what and when?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...