Dashboards & Visualizations

How to know where the macro is used ?

zacksoft_wf
Contributor

we have a lot of contents/knoweldge objects and are trying to weed out the ones that are unused. We are using Enterprise Security and other apps. 
I have identified a few `Macros`  that I want to remove/delete, but before that I want to make sure that they are not used in any Splunk Saved search/correlation search/loop up generating search Or within any SPL for that matter.
Is there a way to find it ?

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@zacksoft_wf 

You can use these also for identifying use of macros.

| rest /services/saved/searches | table search | search search="*<<ENTER_MACRO_NAME>>*"
| rest/servicesNS/-/-/data/ui/views | table "eai:data" | search "eai:data"="*<<ENTER_MACRO_NAME>>*"

 

KV

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@zacksoft_wf 

You can use these also for identifying use of macros.

| rest /services/saved/searches | table search | search search="*<<ENTER_MACRO_NAME>>*"
| rest/servicesNS/-/-/data/ui/views | table "eai:data" | search "eai:data"="*<<ENTER_MACRO_NAME>>*"

 

KV

0 Karma

codebuilder
Influencer

You can use the REST endpoint.

| rest/servicesNS/-/-/data/lookup-table-files
----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...