can Splunk provide the modification time and length of a CSV file?

[awurster]

we use many lookup tables here to check things like blacklists and other IP address lists. i'd like to create a dashboard that shows all the different lookup table files we have configured (within a given app), and then provide both a last modified date and number of entries/records for each.

this is to allow the users or investigation team to verify that they've got the most accurate data.

for example, i'd like to say "foo-list.csv" was modified on 16th Feb, and has 31,000 entries.

[MuS · Accepted solution]

Hi awurster,

regarding the first requirement, the list of all lookup's and their app, you can use this simple REST call:

| rest /services/data/lookup-table-files/ | table title eai:acl.app eai:data updated

Don't be confused by the updated field, this only shows the last time Splunk did read this lookup files, not when the file was updated!

For this requirement, I would setup a [monitor:..] or [fschange:...] to get the time of change and some combination of summary indexing search and outputlookup to populate another lookup containing the lookup files name, time of change and the count of entries for each. Use this as automated lookup and the dashboard will look pretty fancy ....

Hope this helps ...

cheers, MuS