Splunk Search

lookup file no longer being updated - how to identify how it was being updated

vincenp2
New Member

A splunk user has identified that a lookup table has not been updated for some time.

I was previously unaware of this lookup table as it had been created by someone else who no longer works on the system. I would like to investigate what script / report etc has generated and updated the lookup report previously, but I don't know where to start looking.

can anyone help guide me please with perhaps any queries or file searches that might be useful to identify what created the lookup file, and better still, what process/scrip/report was updating the lookup file?

thanks

0 Karma
1 Solution

FrankVl
Ultra Champion

Searching the _internal logs for the lookup name might give some clues (if those go back far enough).

For finding how it got updated, that would likely be a saved search, so if you have file system access on your search head(s), you could scan for savedsearches.conf files and in those search for the lookup name.

View solution in original post

0 Karma

FrankVl
Ultra Champion

Searching the _internal logs for the lookup name might give some clues (if those go back far enough).

For finding how it got updated, that would likely be a saved search, so if you have file system access on your search head(s), you could scan for savedsearches.conf files and in those search for the lookup name.

View solution in original post

0 Karma

vincenp2
New Member

brilliant! many thanks, a trawl of savedsearches.conf has given me the info I need

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!