How do you manage several look-ups reviews?

[AntoineDRN]

Hello Splunkers, 

I come to you in order to gather some tips and tricks around look-ups management.

For example, I have several look-ups used to whitelist some machine, and after a time a part of these machine aren't used anymore. I bet we are not the only one to face this, so I was wondering, how you manage the review and update of these? 

I first had the idea to use the [fschange] stanza on ours to get mofications (with time information and details about the change Add/Delete/Edit). But i also saw that is was deprecated. Is it still a good thing to use in order to manage our look-ups? Is there something that replace this stanza? Because I unfortunately have not found anything. 

I also thought adding columns to have the "Creation date"/"Modification date"/"Too old" or stuff like that for each row. Is that a good enought workaround?

Thanks for your tips! 🙂

Happy Splunking,

A-D

[gcusello]

Hi @AntoineDRN,

I'd create a scheduled search that checks the missing machines, so you can update your lookup when in the results there's a deprecated machine.

Or otherwise (I don't like it) you could also automatically update your lookup using a scheduled search, but I prefer the other solution because it gives me more control.

Ciao.

Giuseppe

[Atriarc · Accepted solution]

I would think that adding an additional column to your lookups containing the epoch time value for when the entry was created (or modified if you want that much granularity/complexity). From there it just becomes a matter of when to roll stale data out of the lookup. 

[AntoineDRN]

That's what I will try to implement.

Thanks for your answer