SPL
List the size of lookup files with an SPL search.
Description
0 0
| rest splunk_server=local /services/data/lookup-table-files/
| rename eai:acl.app as app
| table app title
| search NOT title IN (*.kmz)
| map maxsearches=990 search="| inputlookup $title$
| eval size=0
| foreach * [ eval size=size+coalesce(len('<<FIELD>>'),0), app=\"$app$\", title=$title$ | fields app title size]"
| stats sum(size) by app title
| sort - sum(size)
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.