We have certain automated lookup files, which get updated by various feeds. Any chance to get the properties of these lookup files like last modified, size ? i.e. metadata about the lookup file using REST API?
As per Splunk API, i checked below properties
endpoint, but it can drill down up-to the list of lookup files and not specific lookup/csv files. The last_updated field is incorrect in this endpoint and hence this doesn't work. I'm looking for a similar one
| rest splunk_server=local /services/properties/lookups/
Have you tried | rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
Have you tried | rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
Thank you mate. This one is correct and the updated timestamp seems correct.