Knowledge Management

Is there a way to determine if different Splunk rules are utilizing the same input lookup table without looking through each rule?

Ghanayem1974
Path Finder

Is there a way to determine if different Splunk rules are utilizing the same input lookup table without looking through each rule?

0 Karma
1 Solution

damien_chillet
Builder

You can retrieve SPL for each rules and extract lookup names with a regex using something like this:

| rest /servicesNS/-/-/saved/searches
| rex field=search max_match=10 "inputlookup\s+(append=true\s+)?(?P<lookup>[^\.\s\]]+)"
| mvexpand lookup
| fields title lookup
| stats values(title) by lookup

Tweak regex depending on your use case (this one extract lookups that appear after the inputlookup command).

View solution in original post

0 Karma

damien_chillet
Builder

You can retrieve SPL for each rules and extract lookup names with a regex using something like this:

| rest /servicesNS/-/-/saved/searches
| rex field=search max_match=10 "inputlookup\s+(append=true\s+)?(?P<lookup>[^\.\s\]]+)"
| mvexpand lookup
| fields title lookup
| stats values(title) by lookup

Tweak regex depending on your use case (this one extract lookups that appear after the inputlookup command).

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!