Splunk Search

How do I add a label to a dashboard using rest command for several lookups ?

MeMilo09
Path Finder

Hello There, 

I am able to use the | rest command to obtain the date that the lookup was last updated in Splunk. However, I can only seem to do that with one lookup and I am not able to add the other lookups. How can I add more lookups to the | rex command? 

Lookups I have to add redSox_Report_.csv, yankees_Report_.csv, dodgers_Report.csv? 

I can only add one so far angels_Report_.csv

| rest/servicesNS/-/-/data/lookup-table-files/angels_Report.csv

| eval updated=strptime(updated,"%FT%T%:z")

| eval desired_time=strftime(updated, "%a %m/%d/%Y")

| table desired_time

 




Labels (1)
0 Karma
1 Solution

MeMilo09
Path Finder

I found the solution:

| rest/servicesNS/-/-/data/lookup-table-files search="*_Report.csv"

| eval updated=strptime(updated,"%FT%T%:z")

| eval desired_time=strftime(updated, "%a %m/%d/%Y")

| table desired_time

View solution in original post

0 Karma

MeMilo09
Path Finder

I found the solution:

| rest/servicesNS/-/-/data/lookup-table-files search="*_Report.csv"

| eval updated=strptime(updated,"%FT%T%:z")

| eval desired_time=strftime(updated, "%a %m/%d/%Y")

| table desired_time
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...