https://community.splunk.com/t5/Knowledge-Management/Audit-knowledge-object-usage/m-p/465756#M8122 <P>well, the answer for your questions is: "it depends" but probably couple of them<BR /> it depends on the knowledge objects you are after, for example, you can find the use of lookups in a pretty straight forward way ... look for all your lookup via <CODE>| rest</CODE> find if they are used in a search / saved something pretty much by lookup for searches that have the command <CODE>| lookup</CODE> or <CODE>| inputlookup</CODE> or <CODE>| ouputlookup</CODE><BR /> as for tags, eventtypes, fields and other, it might be a little more complex. <BR /> my approach will be to find the searches you use by a sourcetype as your knowledge object should always be tied to one. if there are sourcetypes you arent using, <BR /> lastly, worthwhile to distinguish between index time and search time knowledge object which is not always an easy task ... </P> Wed, 27 May 2020 23:42:08 GMT adonio 2020-05-27T23:42:08Z https://community.splunk.com/t5/Knowledge-Management/Audit-knowledge-object-usage/m-p/465755#M8121 <P>Hello,</P> <P>I'm trying to audit knowledge object usage. Is there really no way to log when a knowledge object is called? </P> <P>Thanks and Regards.</P> Wed, 27 May 2020 19:44:27 GMT https://community.splunk.com/t5/Knowledge-Management/Audit-knowledge-object-usage/m-p/465755#M8121 ddelmont 2020-05-27T19:44:27Z https://community.splunk.com/t5/Knowledge-Management/Audit-knowledge-object-usage/m-p/465756#M8122 <P>well, the answer for your questions is: "it depends" but probably couple of them<BR /> it depends on the knowledge objects you are after, for example, you can find the use of lookups in a pretty straight forward way ... look for all your lookup via <CODE>| rest</CODE> find if they are used in a search / saved something pretty much by lookup for searches that have the command <CODE>| lookup</CODE> or <CODE>| inputlookup</CODE> or <CODE>| ouputlookup</CODE><BR /> as for tags, eventtypes, fields and other, it might be a little more complex. <BR /> my approach will be to find the searches you use by a sourcetype as your knowledge object should always be tied to one. if there are sourcetypes you arent using, <BR /> lastly, worthwhile to distinguish between index time and search time knowledge object which is not always an easy task ... </P> Wed, 27 May 2020 23:42:08 GMT https://community.splunk.com/t5/Knowledge-Management/Audit-knowledge-object-usage/m-p/465756#M8122 adonio 2020-05-27T23:42:08Z