How to pass calculate the latest row count in multiple lookups?

[rajeshmetso]

Hi All,

I have around 100+ lookups, which get updated daily from indexed data using macro and saved search. I want to find if any of these lookups are getting flushed and row count turns to "0".  I created a lookup with all the lookup names and tried to pass the output to another lookup command and pull the stats. But this is not working. 

Any suggestion to fullfil this requirement would be appreciated

Thanks

Rajesh

[ITWhisperer · Accepted solution]

It can get a bit complicated, but you could try something like this (assuming you have a lookup file with the names of the lookups in a field called file):

| inputlookup lookups.csv
| map search="| inputlookup "$file$"| stats count|eval file=\""$file$"\""

 However, this can sometimes fail if you don't have a definition for the lookup, in which case, try it this way

| inputlookup lookups.csv
| map search="| makeresults | map search=\"| inputlookup "$file$"| stats count\"|eval file=\""$file$"\""

[rajeshmetso]

@ITWhisperer 

Thank you for quick response. This sorted the issue, but am getting only 10 results and below warning.

The search result count (110) exceeds maximum (10), using max. To override it, set maxsearches appropriately.

[ITWhisperer]

map - Splunk Documentation

[rajeshmetso]

@ITWhisperer thank you it worked.

| inputlookup lookups.csv | map search="| makeresults | map search=\"| inputlookup "$file$"| stats count\"|eval file=\""$file$"\"" maxsearches=150