Splunk Cloud Platform

How to determine which logs are being utilized for specific dashboards, use-cases, or other metrics Splunk Cloud ES?

AL3Z
Builder

Hi,
How to determine which logs are being utilized for specific dashboards, use-cases, or other metrics in your Splunk Cloud ES?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There isn't a one-click answer to this question.  Each dashboard or use-case will have to be researched separately.

Simply put, run the base search (everything before the first pipe) and append | stats count by source.  That will produce a list of sources used by that search/use-case.

If the search contains subsearches (via join or append commands then combine the base searches of each subsearch with the base search of the main search using append.

<<base search>>
| append [ <<text before first pipe of subsearch1>>]
| append [ <<text before first pipe of subsearch2>>]
| stats count by source

This method doesn't apply to searches that start with a generating command (tstats, dbxquery, inputlookup, etc.).

Be aware that some sources change names every day.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...