Splunk Search

Lookup file age


Any way to show the age of a lookup file? My users will need to upload new files from time to time and I want them to have a gauge on how old the existing files are.

REST may come further down the line for automation, for now manual upload is our only option.

On the OS side easy enough, in the GUI I cant find a thing.


You could also add a scripted input that periodically checks the age of the lookup files and index the results with Splunk. It should be fairly easy to create a search that produces gauges for the ages of the files. Here's an example scripted input (in python):


import sys,os,datetime,time

FILES_TO_CHECK = [("search","lookup1.csv"),("mcafee_epo","av_threat_types.csv")]

for app,filename in FILES_TO_CHECK:
    p = os.path.join(os.environ['SPLUNK_HOME'],'etc','apps', app, 'lookups',filename)
    if os.path.exists(p):
        age = time.time() - os.stat(p).st_mtime
        print "%s Lookup file=%s in app=%s age=%d seconds" % (datetime.datetime.now(),filename,app,int(age))
        print >>sys.stderr,"Lookup file %s not found (%s)" % (filename, p)

and another example that simply fetch the age for all lookup files:

import sys,os,datetime,time
apps = os.path.join(os.environ['SPLUNK_HOME'],'etc','apps')
for sub in os.listdir(apps):
    lookupsDir = os.path.join(apps,sub,"lookups")
    if os.path.exists(lookupsDir):
        for f in os.listdir(lookupsDir):
            if f.endswith(".csv"):
                p = os.path.join(lookupsDir, f)
                age = time.time() - os.stat(p).st_mtime
                print "%s Lookup file=%s in app=%s has not been modified in age=%d seconds" % (datetime.datetime.now(),f,sub,int(age))


Not directly no - however, you might be able to do a custom search command that basically checks the operating system. I'm just not sure how it would work.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...