Knowledge Management

Finding source of a lookup

Siddharthnegi
Contributor

I want to know which saved search is generating a particular lookup , How do I do that?

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

If the lookup is explicitly generated with the outputlookup command, you can try something like

| rest /servicesNS/-/-/saved/searches
| regex search="outputlookup[^|]+<your_lookup_name>"
| table title eai:acl.app search
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...