Splunk Search

How to write a search that will determine if a lookup file has been updated?

splunkrocks2014
Communicator

How to write a search that will determine if a lookup file has been updated?

Thanks.

0 Karma
1 Solution

DMohn
Motivator

Assuming you have a search that updates your lookup file, the easiest way would be to add another field last_update to your lookup entries. This way you can always tell when the respective entry has been last updated.

View solution in original post

0 Karma

DMohn
Motivator

Assuming you have a search that updates your lookup file, the easiest way would be to add another field last_update to your lookup entries. This way you can always tell when the respective entry has been last updated.

0 Karma

splunkrocks2014
Communicator

The lookup file has the "Last_Updated" field, but it has different timestamps associated with each record. Also, the lookup file is uploaded by the end-users.

0 Karma

DMohn
Motivator

You can still load the lookup file and check for the latest "last_updated" field.
As far as I know there is no built-in possibility to check for a file update.

0 Karma

splunkrocks2014
Communicator

Thanks DMohn

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...