Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Splunk is not displaying the latest time of lo...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk is not displaying the latest time of lookup updated
Splunk is not displaying the latest time of lookup updated
| rest /servicesNS/-/-/data/lookup-table-files
| search title=*
| table title updated
title updated
test.csv 1969-12-31T18:00:00-06:00
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In case anyone runs into this old post with the same issue, I opened a support case and was informed that:
the "updated" field in the API is a generic field on most Splunk APIs to track changes to configuration such as changes in permissions done from the UI. It is not an accurate method to track changes done to the lookup files themselves.
😞
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Was this issue ever resolved? I am seeing the same issue in my SplunkCloud environment.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Definitely open a support case.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I suspect that the system clock on the host OS of your Search Head is borked or there is a Splunk bug somewhere. That says that the timestamp on the file is 0, which should not happen.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @woodcock, I do not see any issue with host OS. Not sure if it is a bug with Splunk, as a similar version of Splunk on the other SH is working fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@DMohn, lookup file was generated from outputlookup.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This time normally indicates, that the corresponding CSV hasn't been updated via Splunk at all. (It is the '0' UNIX timestamp value).
This interface will only show update times, if the lookup file is updates by means of Splunk (eg. outputlookup) - not if it is re-uploaded via the OS.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @ganji
check your user timezone
Harish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@harishalipaka, thanks for replying. User time zone is Default System Timezone and user timezone may not be the issue.
Fun with Regular Expression - multiples of nine
[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...
What’s New & Next in Splunk SOAR
