How do I get a list of all my lookups with their file size?

[BuzzLights10]

Hey Splunkers,

I wanted to get a list of all the lookup files on my SH and their file sizes along with other data. I can't get the size from the rest API. Appreciate any and all answers. 

Below are the searches I've been trying to use:

| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app
|foreach title
[| inputlookup <<FIELD>>
| foreach * 
    [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] 
| addtotals b_* fieldname=b 
| stats sum(b) as b 
| eval mb=b/1000/1000, gb=mb/1000 
| fields mb]

The foreach does not allow non-streaming commands and thus this does not work. Using a direct eval like below:

| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app
|eval size=
[| inputlookup 'title'
| foreach * 
    [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] 
| addtotals b_* fieldname=b 
| stats sum(b) as b 
| eval mb=b/1000/1000, gb=mb/1000 
| fields mb]

This also does not work since the inner search cannot see the outer values. 

I have been trying to work with subsearches, foreach and the map command but couldn't get anywhere.


Thanks in advance folks

[richgalloway]

It may not be all-inclusive, but you can get lookup file sizes from the audit index.

index=_audit isdir=0 size lookups action IN (update created modified add) 
| stats latest(eval(size/1024/1024)) as size_mb latest(_time) as _time by path

[BuzzLights10]

Hey @richgalloway ,

Thanks for the reply!

Would I need to run this over a larger time range to get as many lookups in as possible? Any approximate how large a range would get the best results??

[richgalloway]

It depends on how often bundles are rebuilt on your system.  Start with 4 hours and add or subtract as necessary.

[BuzzLights10]

A majority of these are blacklisted from bundle replication and only exist on the SH cluster. I will check this out still.

Thanks!