- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

koshyk
Super Champion
01-31-2019
05:19 AM
We have certain automated lookup files, which get updated by various feeds. Any chance to get the properties of these lookup files like last modified, size ? i.e. metadata about the lookup file using REST API?
As per Splunk API, i checked below properties
endpoint, but it can drill down up-to the list of lookup files and not specific lookup/csv files. The last_updated field is incorrect in this endpoint and hence this doesn't work. I'm looking for a similar one
| rest splunk_server=local /services/properties/lookups/
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DMohn
Motivator
01-31-2019
05:26 AM
Have you tried | rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

DMohn
Motivator
01-31-2019
05:26 AM
Have you tried | rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

koshyk
Super Champion
01-31-2019
05:30 AM
Thank you mate. This one is correct and the updated timestamp seems correct.
