Alerting

How to find out a lookup is used in how many saved searches.

msplunk33
Path Finder

I have a few lookups created by users they left the organization. We need to remove this lookups since it take large amount of space. Before we remove is there any query we can find out  how many searches using this lookup.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is easiest to do from the CLI.  First, search all transforms.conf files to see if a lookup definition uses the lookup files.

find /opt/splunk/etc -name transforms.conf -print0 | xargs -r0 grep #lookupfilename#

Replace #lookupfilename# with the actual name of the lookup (probably a .csv file).  Repeat this for each lookup.  The output, if any, will tell you if the lookup file is used by a lookup definition.

Next, search savedsearches.conf files for the lookups and lookup files you've identified.

find /opt/splunk/etc -name savedsearches.conf -print0 | xargs -r0 grep #lookupname#

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is easiest to do from the CLI.  First, search all transforms.conf files to see if a lookup definition uses the lookup files.

find /opt/splunk/etc -name transforms.conf -print0 | xargs -r0 grep #lookupfilename#

Replace #lookupfilename# with the actual name of the lookup (probably a .csv file).  Repeat this for each lookup.  The output, if any, will tell you if the lookup file is used by a lookup definition.

Next, search savedsearches.conf files for the lookups and lookup files you've identified.

find /opt/splunk/etc -name savedsearches.conf -print0 | xargs -r0 grep #lookupname#

 

---
If this reply helps you, Karma would be appreciated.

scelikok
SplunkTrust
SplunkTrust

Hi @msplunk33,

You can use below search by updating your lookup file name.

index=_audit action=search search_id=* *lookup_name*
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...