Hey Splunkers,
I wanted to get a list of all the lookup files on my SH and their file sizes along with other data. I can't get the size from the rest API. Appreciate any and all answers.
Below are the searches I've been trying to use:
| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app
|foreach title
[| inputlookup <<FIELD>>
| foreach *
[| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
| addtotals b_* fieldname=b
| stats sum(b) as b
| eval mb=b/1000/1000, gb=mb/1000
| fields mb]
The foreach does not allow non-streaming commands and thus this does not work. Using a direct eval like below:
| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app
|eval size=
[| inputlookup 'title'
| foreach *
[| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
| addtotals b_* fieldname=b
| stats sum(b) as b
| eval mb=b/1000/1000, gb=mb/1000
| fields mb]
This also does not work since the inner search cannot see the outer values.
I have been trying to work with subsearches, foreach and the map command but couldn't get anywhere.
Thanks in advance folks
It may not be all-inclusive, but you can get lookup file sizes from the audit index.
index=_audit isdir=0 size lookups action IN (update created modified add)
| stats latest(eval(size/1024/1024)) as size_mb latest(_time) as _time by path
Hey @richgalloway ,
Thanks for the reply!
Would I need to run this over a larger time range to get as many lookups in as possible? Any approximate how large a range would get the best results??
It depends on how often bundles are rebuilt on your system. Start with 4 hours and add or subtract as necessary.
A majority of these are blacklisted from bundle replication and only exist on the SH cluster. I will check this out still.
Thanks!