Hi all,
we have hundreds of saved searches,but the problem is while creating savedsearches they were used index= *
instead of using index fully qualified name.so i want to list out how many savedsearches has index=*
thanks.
You can also try
| regex search=.*index\s*=\s*_?\*\s
@john_q - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!
| rest /servicesNS/-/-/saved/searches | fields title search eai:acl.app eai:acl.owner | eval var1=if(match(search,"index=*"), "TUNE-ME", "OK") | where var1 = "TUNE-ME"
upvote for "TUNE-ME", but remember to mark your code.
Give this a try
| rest /servicesNS/-/-/saved/search splunk_server=local
| regex search=".*index\s*=\s*\*.+"
| table title eai:acl.owner eai:acl.app cron_schedule dispatch.*_time search
Hi John_q
Try and run this search:
This is not perfect but if you will click at the arrow next to the search field in the table, it will sort searches alphabetically
and will bring the index=*
searches to the top of the list
| rest /services/saved/searches
| table search eai:acl.owner title search
| search search="index=*"
Hope it helps