Splunk Search

Check if csv files have been updated to latest versions

robnewman666
Path Finder

Is there a way of checking if the latest csv updates were successful and if they were the most up to date versions (as I have csv files updated daily) - also if they were successful when they were run via scheduled tasks?

Labels (1)
Tags (3)
0 Karma

robnewman666
Path Finder

I think what I am after is a way of confirming the upload mechanism and if the csv files were uploaded, as I update them regularly, and have quite a few.

0 Karma

aasabatini
Motivator

Hi @robnewman666 

I don't really understand your question, but if you try to check last update on csv file indexed on splunk, you can use this search to check the date.

| metadata type=sources index=<your_index> | search source=<your_csv_file>

and check date field.

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

robnewman666
Path Finder

Thanks, but not getting any data on my csv files from metadata. 😞

0 Karma

yuanliu
SplunkTrust
SplunkTrust

By metadata, I speculate that the "csv file" in question is uploaded for lookup purposes.  If so, the easiest  solution would be to  add a timestamp field to the CSV, and use "| inputlookup" command to check if the timestamp agrees with your latest scheduled update.  You can also use a monotonous version field, and compare that field to your upload scheme.  Such an auxiliary field does not even have to appear in every row.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@yuanliu Please can you explain what you mean by monotonous version field and how you would set this up?

0 Karma

yuanliu
SplunkTrust
SplunkTrust
what you mean by monotonous version field and how you would set this up?

Same concept as a timestamp field.   Let's say in the 1st upload, set a version column to value 1, and each subsequent uploads just increment version, to 2, 3, 4, etc.  The operator will need to know which version the latest upload is supposed to be, of course.  Therefore, this is less convenient and perhaps less practical than straight timestamp.

0 Karma