topic Re: Splunk in Splunk Search

Search for "index=*" in searches

sverdhan — Wed, 23 Apr 2025 14:25:01 GMT

Hello guys,

I need a splunk query that list out all the alerts that have index=* in their query. Unfortunately, I can't use rest services so kindly suggest me how can i do it without using rest.

Re: Splunk

ITWhisperer — Wed, 23 Apr 2025 08:44:58 GMT

You could look through the _internal index to see what searches have been performed. This only tells you what have been executed, not what could potentially execute i.e. there could still be alerts which haven't run but may run in the future which use index=*

Re: Splunk

livehybrid — Wed, 23 Apr 2025 09:23:11 GMT

Hi @sverdhan

You can use the _audit index to find these, its not possible to search for a literal asterisk in Splunk but you can use a match command within where to filter as below. Note, the NOT "index=_audit" is to stop your own searches for asterisks searches from coming back!

index=_audit info=granted NOT "index=_audit" NOT typeahead | where match(search, ",*index\s?=\s?\*")

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Search for "index=*" in searches

PickleRick — Wed, 23 Apr 2025 14:29:04 GMT

Remember that searches might query all indexes even if they don't have verbatim "index=*" in them. There are several possible cases which might cause that behaviour:

1) Default indexes defined for a role (you should not do that but it is possible)

2) Eventtype

3) index IN (*)

4) macro

5) Data model

And please try to set a more descriptive topic for the thread next time.

Re: Search for "index=*" in searches

livehybrid — Wed, 23 Apr 2025 21:22:14 GMT

This is true @sverdhan - As @PickleRick has said, this might not cover everything you're expecting.

I spent a big chunk of time once trying to find "every" combination for a project I was working on to automatically notify of people doing this, however they often found clever ways around, things like using inputlookup, makeresults etc in subsearches.

However, it might catch "most" of your queries - ultimately your mileage may vary!

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing