Lookup monitoring

Lookup monitoring turns Splunk lookups — CSV files and KV Store collections — into first-class DSM entities, so a lookup that silently stops being updated (a stale threat-intel feed, an abandoned asset list) becomes visible as a problem. It is a dedicated DSM search mode.

How it works

  • Choose lookups (CSV file & KV Store monitoring) in the Hybrid Trackers wizard. Instead of an SPL editor you set the lookup type (csv, kvstore or both), the app namespace(s) (a name, a glob like TA-*, or a comma list) and a lookup name pattern (regex) — or let the built-in Populate pickers discover the namespaces and lookups available on the deployment and fill those in for you.

  • Each matching lookup becomes one entity, under the special lookups index.

  • Freshness is determined differently per type:

    • CSV — from the file’s real filesystem modification time (not the unreliable knowledge-object timestamp), with a streaming, gzip-aware row count.

    • KV Store — splunkd only tracks the key and user, so you provide a preference-ordered list of candidate time fields (_time, mtime, updated_at, …); the first one that parses wins. If none match, freshness cannot be determined (volume is still trackable).

  • Alerting on staleness and record count — a lookup has no index time, so latency is neutralised. TrackMe alerts on staleness (“not updated in the past N seconds”, default 24 hours, set in the wizard and editable later) and on the record count: by default an empty lookup (0 records) flips red, and you can require a minimum of N records per entity (2.4.8).

Standard DSM machinery still applies — outlier detection on the row count works out of the box (a 50,000-row lookup dropping to 200 is flagged automatically), and the full set of entity tabs is available. Lookup entities also get a lookup-native presentation: a last-known records KPI tile, with status messages, charts and alert emails framed as records and update frequency rather than feed latency.

Note

  • Lookup monitoring is powered by the trackmelookupsmonitor command, shipped in a small companion add-on, TA-trackme-lookupmonitor. For lookups on a remote search head, install that add-on on the remote SH (the full app is not required there) and choose the remote account — TrackMe wraps the command in splunkremotesearch automatically (see Remote Splunk deployments).

  • Discovery runs as the tenant owner — lookups that user cannot see are not found.

  • This supersedes the older elastic-source from lookup: approach.

See also