Splunk search for Size of All Lookup Files on Search Head

Copy


			| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
| fields title eai:acl.owner eai:acl.app
| where !match(title,"\.mlmodel")
| rename eai:acl.* as *
| map
    [ | inputlookup $title$ | foreach *
        [ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
    | addtotals b_* fieldname=b
    | stats sum(eval(b/1024/1024)) as mb
    | eval name="$title$", owner="$owner$", app="$app$" ] maxsearches=1000

This search will provide the estimated size (MB) of all lookup table files that are found on the Splunk SH you run it on. This is useful for identifying large lookup files in your environment.

0 comments

[0]

Category:

General Splunk

Tags:

rest lookup inputlookup lookup size

Search Commands: