- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to determine which logs are being utilized for specific dashboards, use-cases, or other metrics Splunk Cloud ES?
AL3Z
Builder
05-11-2023
01:21 AM
Hi,
How to determine which logs are being utilized for specific dashboards, use-cases, or other metrics in your Splunk Cloud ES?
Labels (5)
Labels
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
05-12-2023
05:48 AM
There isn't a one-click answer to this question. Each dashboard or use-case will have to be researched separately.
Simply put, run the base search (everything before the first pipe) and append | stats count by source. That will produce a list of sources used by that search/use-case.
If the search contains subsearches (via join or append commands then combine the base searches of each subsearch with the base search of the main search using append.
<<base search>>
| append [ <<text before first pipe of subsearch1>>]
| append [ <<text before first pipe of subsearch2>>]
| stats count by source
This method doesn't apply to searches that start with a generating command (tstats, dbxquery, inputlookup, etc.).
Be aware that some sources change names every day.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
