Check if csv files have been updated to latest versions

[robnewman666]

Is there a way of checking if the latest csv updates were successful and if they were the most up to date versions (as I have csv files updated daily) - also if they were successful when they were run via scheduled tasks?

[robnewman666]

I think what I am after is a way of confirming the upload mechanism and if the csv files were uploaded, as I update them regularly, and have quite a few.

[aasabatini]

Hi @robnewman666 

I don't really understand your question, but if you try to check last update on csv file indexed on splunk, you can use this search to check the date.

| metadata type=sources index=<your_index> | search source=<your_csv_file>

and check date field.

[robnewman666]

Thanks, but not getting any data on my csv files from metadata. 😞

[yuanliu]

By metadata, I speculate that the "csv file" in question is uploaded for lookup purposes.  If so, the easiest  solution would be to  add a timestamp field to the CSV, and use "| inputlookup" command to check if the timestamp agrees with your latest scheduled update.  You can also use a monotonous version field, and compare that field to your upload scheme.  Such an auxiliary field does not even have to appear in every row.

[ITWhisperer]

@yuanliu Please can you explain what you mean by monotonous version field and how you would set this up?

[yuanliu]

what you mean by monotonous version field and how you would set this up?

---

Same concept as a timestamp field.   Let's say in the 1st upload, set a version column to value 1, and each subsequent uploads just increment version, to 2, 3, 4, etc.  The operator will need to know which version the latest upload is supposed to be, of course.  Therefore, this is less convenient and perhaps less practical than straight timestamp.