topic Re: How do I search for a list of Saves searches that don't use index name for searching in Splunk Ent. or ES. Thank u a in Splunk Search

How do I search for a list of Saves searches that don't use index name for searching in Splunk Ent. or ES. Thank u a lot

SamHTexas — Tue, 31 Aug 2021 15:29:43 GMT

I need to find a list of saved searches that don't use the index name in searching please. Any way to list the name of the users with this list, any cool SPLs ? Thank u in advance. Much appreciated.

Re: How do I search for a list of Saves searches that don't use index name for searching in Splunk Ent. or ES. Thank u a

codebuilder — Tue, 31 Aug 2021 15:49:58 GMT

Try this:

| rest /servicesNS/-/-/saved/searches | search search!=*index* |table search eai:acl.owner is_scheduled

Re: How do I search for a list of Saves searches that don't use index name for searching in Splunk Ent. or ES. Thank u a

SamHTexas — Tue, 31 Aug 2021 16:16:16 GMT

Thx bro for your reply. From your point of view what issues do u see if a search is not using an Index name? Am looking from a Security point of view? Thanks again.

Re: How do I search for a list of Saves searches that don't use index name for searching in Splunk Ent. or ES. Thank u a

PickleRick — Tue, 31 Aug 2021 19:33:10 GMT

What do you mean "don't use an index"? You can quite easily find searches which don't have said index literarily entered as a part of the search but what if the searches reference that index in another way? A macro, for example. Or a subsearch?

BTW, just because a search doesn't use a "index=something" condition, doesn't mean that it's "bad". You might - for example have searches populating lookups by performing ldapsearch. Or you might use a search to check a dynamicaly created lookup for its validity of some kind. Or any other legit reason not to have an index explicitly included i the search.

Re: How do I search for a list of Saves searches that don't use index name for searching in Splunk Ent. or ES. Thank u a

isoutamo — Tue, 31 Aug 2021 20:50:11 GMT

Probably the biggest issue is that you didn’t know which indexes the query is using (or better to say which it should use). As @PickleRick @said there are many ways to define which index it should use other than index=abc (e.g. eventtypes, auth config files, macros etc.). As those can changed time by time, you couldn’t know later on which indexes are used (should use) by querying that from logs.

r. Ismo