Is there any way to track deleted lookup files?

buttsurfer — Tue, 10 Jan 2023 15:23:03 GMT

I'm trying to identify all the dashboards broken from lookup files being deleted. But since there's way too many dashboards, is there any not-so-manual way to find out all the inconsistencies regarding lookup files without running the dashboards one by one?

Re: Is there any way to track deleted lookup files?

richgalloway — Tue, 10 Jan 2023 20:29:21 GMT

Here is a query that fetches all of the lookups referenced by dashboards and compares that to the lookups defined on the system.

| rest /servicesNS/-/-/data/ui/views splunk_server=local | search * | rename eai:data as data title as dashboard ```Look for 'lookup' and 'inputlookup' commands in the dashboard ("view")``` | regex data="\|\s*(?:lookup|inputlookup)\s+" ```Get the first 2 arguments to the command``` | rex max_match=0 field=data "\|\s*(?:lookup|inputlookup)\s+(?<kw1>[^\s\]]+)\s+(?<kw2>[^\s\]]+)" ```Zip the arguments together so we can retain the pairing during mxexpand``` | eval kws=mvzip(kw1,kw2) | mvexpand kws ```Separate the args``` | eval kws=split(kws, ",") | eval kw1=mvindex(kws,0), kw2=mvindex(kws,1) ```If the first argument is "append=<something>" then the lookup name is in the 2nd arg``` | eval lookup=if(match(kw1,"append=\w+"), kw2, kw1) | dedup dashboard eai:acl.app eai:acl.owner lookup | search NOT ```Build a list of existing lookups to exclude from the results``` [| rest /servicesNS/-/-/data/lookup-table-files | fields title | rename title as lookup | append [| rest /servicesNS/-/-/data/props/lookups | fields transform | rename transform as lookup ] | dedup lookup | format] | table dashboard eai:acl.app eai:acl.owner lookup

topic Is there any way to track deleted lookup files? in Splunk Enterprise

Is there any way to track deleted lookup files?

Re: Is there any way to track deleted lookup files?