Splunk search for Size of All Lookup Files on Search Head

Copy
| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files | fields title eai:acl.owner eai:acl.app | where !match(title,"\.mlmodel") | rename eai:acl.* as * | map [ | inputlookup $title | foreach * [ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ] | addtotals b_* fieldname=b | stats sum(eval(b/1024/1024)) as mb | eval name="$title$", owner="$owner$", app="$app$" ] maxsearches=1000
This search will provide the estimated size (MB) of all lookup table files that are found on the Splunk SH you run it on. This is useful for identifying large lookup files in your environment.
0 comments

Category:

General Splunk


Tags:

rest lookup inputlookup lookup size

Search Commands:

Sign in or Register to submit a comment