I'm trying to do some lookup table rationalization because we have some sources changing that we're pulling into lookup tables and I'll need to find new sources for some of my data types. I'm trying to find a better way to get stats on fields used for lookup and inputlookup matches as well as output results, so I have a better way to weight the criticality of certain data sources in my org and push for better data coverage at the source for important fields. The way I've done this so far is through | rest for saved searches and macros followed by an unholy amount of regexes to capture all of the worry-free use of cases and conditions and in-line renames using AS and WHERE. I haven't even started with views... There simply must be a better way.
Is there anything in splunk_introspection that would basically count the equivalent of sum(count) of a particular lookup field by any saved search or macro?
