topic Re: list out saved searches which are used index=* instated of using index fully qualified name in Splunk Search

How to list out saved searches which are used index=* instated of using index fully qualified name?

john_q — Mon, 05 Sep 2022 21:26:05 GMT

Hi all,
we have hundreds of saved searches,but the problem is while creating savedsearches they were used index= *

instead of using index fully qualified name.so i want to list out how many savedsearches has index=*

thanks.

Re: list out saved searches which are used index=* instated of using index fully qualified name

adonio — Thu, 23 Feb 2017 21:08:37 GMT

Hi John_q
Try and run this search:

This is not perfect but if you will click at the arrow next to the search field in the table, it will sort searches alphabetically
and will bring the index=* searches to the top of the list

| rest /services/saved/searches
| table search eai:acl.owner title search
| search search="index=*"

Hope it helps

Re: list out saved searches which are used index=* instated of using index fully qualified name

somesoni2 — Thu, 23 Feb 2017 21:26:29 GMT

Give this a try

| rest /servicesNS/-/-/saved/search splunk_server=local
| regex search=".*index\s*=\s*\*.+"
| table title eai:acl.owner eai:acl.app cron_schedule dispatch.*_time search

Re: list out saved searches which are used index=* instated of using index fully qualified name

SathyaNarayanan — Fri, 31 Mar 2017 15:12:52 GMT

| rest /servicesNS/-/-/saved/searches | fields title search eai:acl.app eai:acl.owner | eval var1=if(match(search,"index=*"), "TUNE-ME", "OK") | where var1 = "TUNE-ME"

Re: list out saved searches which are used index=* instated of using index fully qualified name

DalJeanis — Fri, 31 Mar 2017 17:12:24 GMT

upvote for "TUNE-ME", but remember to mark your code.

Re: list out saved searches which are used index=* instated of using index fully qualified name

aaraneta_splunk — Fri, 21 Apr 2017 03:14:20 GMT

@john_q - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

Re: list out saved searches which are used index=* instated of using index fully qualified name

sylvia_gerges — Mon, 05 Sep 2022 13:59:28 GMT

You can also try

| regex search=.*index\s*=\s*_?\*\s