Archive
Highlighted

list out saved searches which are used index=* instated of using index fully qualified name

Explorer

Hi all,
we have hundreds of saved searches,but the problem is while creating savedsearches they were used index= *

instead of using index fully qualified name.so i want to list out how many savedsearches has index=*

thanks.

Tags (1)
0 Karma
Highlighted

Re: list out saved searches which are used index=* instated of using index fully qualified name

SplunkTrust
SplunkTrust

Hi John_q
Try and run this search:

This is not perfect but if you will click at the arrow next to the search field in the table, it will sort searches alphabetically
and will bring the index=* searches to the top of the list

| rest /services/saved/searches
| table search eai:acl.owner title search
| search search="index=*"

Hope it helps

0 Karma
Highlighted

Re: list out saved searches which are used index=* instated of using index fully qualified name

SplunkTrust
SplunkTrust

Give this a try

| rest /servicesNS/-/-/saved/search splunk_server=local
| regex search=".*index\s*=\s*\*.+"
| table title eai:acl.owner eai:acl.app cron_schedule dispatch.*_time search 
Highlighted

Re: list out saved searches which are used index=* instated of using index fully qualified name

Path Finder

| rest /servicesNS/-/-/saved/searches | fields title search eai:acl.app eai:acl.owner | eval var1=if(match(search,"index=*"), "TUNE-ME", "OK") | where var1 = "TUNE-ME"

Highlighted

Re: list out saved searches which are used index=* instated of using index fully qualified name

SplunkTrust
SplunkTrust

upvote for "TUNE-ME", but remember to mark your code.

0 Karma
Highlighted

Re: list out saved searches which are used index=* instated of using index fully qualified name

Splunk Employee
Splunk Employee

@john_q - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma