Splunk Search

How do I get a list of all my lookups with their file size?

BuzzLights10
Explorer

Hey Splunkers,

I wanted to get a list of all the lookup files on my SH and their file sizes along with other data. I can't get the size from the rest API. Appreciate any and all answers. 

Below are the searches I've been trying to use:

| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app

|foreach title
[| inputlookup <<FIELD>>
| foreach * 
    [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] 
| addtotals b_* fieldname=b 
| stats sum(b) as b 
| eval mb=b/1000/1000, gb=mb/1000 
| fields mb]

The foreach does not allow non-streaming commands and thus this does not work. Using a direct eval like below:

| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app
|eval size=
[| inputlookup 'title'
| foreach * 
    [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] 
| addtotals b_* fieldname=b 
| stats sum(b) as b 
| eval mb=b/1000/1000, gb=mb/1000 
| fields mb]

This also does not work since the inner search cannot see the outer values. 


I have been trying to work with subsearches, foreach and the map command but couldn't get anywhere.


Thanks in advance folks

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It may not be all-inclusive, but you can get lookup file sizes from the audit index.

index=_audit isdir=0 size lookups action IN (update created modified add) 
| stats latest(eval(size/1024/1024)) as size_mb latest(_time) as _time by path
---
If this reply helps you, Karma would be appreciated.
0 Karma

BuzzLights10
Explorer

Hey @richgalloway ,

Thanks for the reply!

Would I need to run this over a larger time range to get as many lookups in as possible? Any approximate how large a range would get the best results??

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends on how often bundles are rebuilt on your system.  Start with 4 hours and add or subtract as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

BuzzLights10
Explorer

A majority of these are blacklisted from bundle replication and only exist on the SH cluster. I will check this out still.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...