Reporting

how can i see all of the searches that are looking for a specific field?

matt
Splunk Employee
Splunk Employee

We are making some changes to our system which requires a field name in the raw event to be changed. We'd like to know the impact to all our users' searches and dashboards that make reference to the field. Is there a way to get an inventory of all the saved searches and dashboards with the field foo in the search string?

1 Solution

Flynt
Splunk Employee
Splunk Employee

You can search the in-line searches used in public views for a particular field by running the following -

 |rest /servicesNS/-/-/data/ui/views  splunk_server=local |table author eai:acl.app id eai:data title label|rex max_match=0 field=eai:data "\<query\>(?P<search_used>.*)\<\/query\>"|search search_used!=""|mvexpand search_used|fields - eai:data |table *|search search_used="*DESIREDFIELD*"

This will list all public views and their respective searches. Notice that we are only asking for the views on the LOCAL instance. If you want to search all views in all search heads remove splunk_server=local

To search public saved searches for a particular field -

|rest /servicesNS/-/-/saved/searches |fields author title qualifiedSearch |eval qualifiedSearch=lower(qualifiedSearch) |search qualifiedSearch="*DESIREDFIELD*"

View solution in original post

landen99
Motivator

The first search of the accepted answer has dashboard formatting in the regex (gt/lt) not conducive to the search line and also could benefit from using the regex command to filter:

|rest /servicesNS/-/-/data/ui/views  splunk_server=local | regex eai:data="query" | table author eai:acl.app id eai:data title label|rex max_match=0 field=eai:data "\<query\> *(?P<search_used>[^\<]+)\<\/query\>" | search search_used=* | mvexpand search_used

followed by: | regex search_used="." | fields - eai:data

Where the dot in the regex command is replaced by the fieldname token.

While it is crude to search for the name without the field usage format/context, it will work for most cases. More effort to key on field usage context would produce more accurate results.

Flynt
Splunk Employee
Splunk Employee

You can search the in-line searches used in public views for a particular field by running the following -

 |rest /servicesNS/-/-/data/ui/views  splunk_server=local |table author eai:acl.app id eai:data title label|rex max_match=0 field=eai:data "\&lt;query\&gt;(?P&lt;search_used&gt;.*)\&lt;\/query\&gt;"|search search_used!=""|mvexpand search_used|fields - eai:data |table *|search search_used="*DESIREDFIELD*"

This will list all public views and their respective searches. Notice that we are only asking for the views on the LOCAL instance. If you want to search all views in all search heads remove splunk_server=local

To search public saved searches for a particular field -

|rest /servicesNS/-/-/saved/searches |fields author title qualifiedSearch |eval qualifiedSearch=lower(qualifiedSearch) |search qualifiedSearch="*DESIREDFIELD*"
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...