How to list out all the lookups and display count of records present in each lookup?

[himanshu1]

Hi Friends,

I am trying to list out all the available splunk lookups and want to display count of records present in each lookups.

However i found rest command to list out all the lookups but how to get count of records for each lookup ?

Rest command : 

| rest/servicesNS/-/-/data/lookup-table-files |table title 

 I want to display count of records present in each lookup in another column. Is it possible to display with SPL?

Requesting your valuable feedback and help.

Thank you in advance.

Himanshu

[ITWhisperer]

You could try something like this (although you may get some errors if your definitions aren't complete):

| rest/servicesNS/-/-/data/lookup-table-files
| table title
| map maxsearches=200 search="| inputlookup $title$ | eval title="$title$" | stats count by title"

Also, note you may have to adjust maxsearches depending on how many files you have. 

[himanshu1]

Thank you so much for your valuable feedback.

Query is working fine but it gets terminated if it encounters any invalid lookup.

any workaround to fix this issue ?

Thank You,