Alerting

How to find out a lookup is used in how many saved searches.

msplunk33
Path Finder

I have a few lookups created by users they left the organization. We need to remove this lookups since it take large amount of space. Before we remove is there any query we can find out  how many searches using this lookup.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is easiest to do from the CLI.  First, search all transforms.conf files to see if a lookup definition uses the lookup files.

find /opt/splunk/etc -name transforms.conf -print0 | xargs -r0 grep #lookupfilename#

Replace #lookupfilename# with the actual name of the lookup (probably a .csv file).  Repeat this for each lookup.  The output, if any, will tell you if the lookup file is used by a lookup definition.

Next, search savedsearches.conf files for the lookups and lookup files you've identified.

find /opt/splunk/etc -name savedsearches.conf -print0 | xargs -r0 grep #lookupname#

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is easiest to do from the CLI.  First, search all transforms.conf files to see if a lookup definition uses the lookup files.

find /opt/splunk/etc -name transforms.conf -print0 | xargs -r0 grep #lookupfilename#

Replace #lookupfilename# with the actual name of the lookup (probably a .csv file).  Repeat this for each lookup.  The output, if any, will tell you if the lookup file is used by a lookup definition.

Next, search savedsearches.conf files for the lookups and lookup files you've identified.

find /opt/splunk/etc -name savedsearches.conf -print0 | xargs -r0 grep #lookupname#

 

---
If this reply helps you, Karma would be appreciated.

scelikok
SplunkTrust
SplunkTrust

Hi @msplunk33,

You can use below search by updating your lookup file name.

index=_audit action=search search_id=* *lookup_name*
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...