https://community.splunk.com/t5/Splunk-Search/validate-access-to-knowledge-object/m-p/479100#M134309 <P>It's not trivial. Start by searching all of your savedsearches.conf files for the lookup file name. Then search _internal for accesses to those searches.<BR /> Then search all of your macros.conf files for the lookup file name. Find out where those macros are used then search _internal for those searches.<BR /> Finally (if I didn't forget something), search all of your dashboards for the lookup file name then search _internal for accesses to those dashboards.</P> Tue, 25 Feb 2020 21:00:03 GMT richgalloway 2020-02-25T21:00:03Z https://community.splunk.com/t5/Splunk-Search/validate-access-to-knowledge-object/m-p/479099#M134308 <P>Good afternoon</P> <P>I am trying to perform an audit of the environmental lookups and I need to know if there is any query that allows to validate whether this knowledge object is being used or accessed</P> <P>Any information is appreciated</P> <P>Best regards</P> Tue, 25 Feb 2020 20:21:24 GMT https://community.splunk.com/t5/Splunk-Search/validate-access-to-knowledge-object/m-p/479099#M134308 efaundez 2020-02-25T20:21:24Z https://community.splunk.com/t5/Splunk-Search/validate-access-to-knowledge-object/m-p/479100#M134309 <P>It's not trivial. Start by searching all of your savedsearches.conf files for the lookup file name. Then search _internal for accesses to those searches.<BR /> Then search all of your macros.conf files for the lookup file name. Find out where those macros are used then search _internal for those searches.<BR /> Finally (if I didn't forget something), search all of your dashboards for the lookup file name then search _internal for accesses to those dashboards.</P> Tue, 25 Feb 2020 21:00:03 GMT https://community.splunk.com/t5/Splunk-Search/validate-access-to-knowledge-object/m-p/479100#M134309 richgalloway 2020-02-25T21:00:03Z