Splunk Search

How do I get a list of all my lookups with their file size?

BuzzLights10
Explorer

Hey Splunkers,

I wanted to get a list of all the lookup files on my SH and their file sizes along with other data. I can't get the size from the rest API. Appreciate any and all answers. 

Below are the searches I've been trying to use:

| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app

|foreach title
[| inputlookup <<FIELD>>
| foreach * 
    [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] 
| addtotals b_* fieldname=b 
| stats sum(b) as b 
| eval mb=b/1000/1000, gb=mb/1000 
| fields mb]

The foreach does not allow non-streaming commands and thus this does not work. Using a direct eval like below:

| rest/servicesNS/-/-/data/lookup-table-files
| rename "eai:acl.app" as app, "eai:acl.owner" as owner, "eai:acl.sharing" as sharing, "eai:data" as path
| table title owner sharing app
|eval size=
[| inputlookup 'title'
| foreach * 
    [| eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] 
| addtotals b_* fieldname=b 
| stats sum(b) as b 
| eval mb=b/1000/1000, gb=mb/1000 
| fields mb]

This also does not work since the inner search cannot see the outer values. 


I have been trying to work with subsearches, foreach and the map command but couldn't get anywhere.


Thanks in advance folks

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It may not be all-inclusive, but you can get lookup file sizes from the audit index.

index=_audit isdir=0 size lookups action IN (update created modified add) 
| stats latest(eval(size/1024/1024)) as size_mb latest(_time) as _time by path
---
If this reply helps you, Karma would be appreciated.

BuzzLights10
Explorer

Hey @richgalloway ,

Thanks for the reply!

Would I need to run this over a larger time range to get as many lookups in as possible? Any approximate how large a range would get the best results??

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends on how often bundles are rebuilt on your system.  Start with 4 hours and add or subtract as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

BuzzLights10
Explorer

A majority of these are blacklisted from bundle replication and only exist on the SH cluster. I will check this out still.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...