How can I see what Searches/Stories from "ES Content Update" App are viable in my environment?

[woodcock]

I need something programatic to sort through the hundreds and hundreds of searches.

[Noah_Woodcock · Accepted solution]

This does it nicely:

|rest/servicesNS/-/DA-ESS-ContentUpdate/saved/searches splunk_server=local
| search eai:acl.app="DA-ESS-ContentUpdate" OR request.ui_dispatch_app="DA-ESS-ContentUpdate"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title description cron_schedule allow_skew dispatch.earliest_time dispatch.latest_time alert_severity search
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description*
| sort 0 title
| streamstats count AS Serial
| rex field=search max_match=0 "sourcetype[\s\r\n=\"]+(?<sourcetype>[^\)\r\n\s]+)"
| eval sourcetype=mvdedup(sourcetype)
| rex field=search max_match=0 "[\s\r\n]+datamodel[\s\r\n=\"]+(?<datamodel>[^\)\r\n\s\.]+)"
| eval datamodel=mvdedup(datamodel)
| eval which="DA-ESS-ContentUpdate"
| append [
|tstats count WHERE index=* earliest=-7d@d BY sourcetype
| search sourcetype!="*too_small"
| table sourcetype
| eval which="sourcetypes"]
| append [
|rest/servicesNS/-/Splunk_SA_CIM/data/models splunk_server=local
| search eai:acl.app="Splunk_SA_CIM"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS definition_JSON
| sort 0 title
| streamstats count AS Serial
| search acceleration=1
| table title
| rename title AS datamodel
| eval which="datamodels"]
| multireport
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY datamodel
| search whichCount>1 ]
[ stats dc(title) AS titleCount list(*) AS * dc(which) AS whichCount BY sourcetype
| search whichCount>1 ]
| streamstats count AS Serial
| foreach * [ eval <<FIELD>> = mvdedup(<<FIELD>>) ]
| rename COMMENT AS "Remove what is below to see them as groups of searches; below splits it out as 1 search/event"
| eval tuple = mvzip(title, mvzip(search, description, ":::"), ":::")
| fields - title search description
| mvexpand tuple
| rex field=tuple "^(?<title>.+?):::(?<search>.+?):::(?<description>.+)$"
| fields - tuple
| rename Serial AS GroupMembership
| streamstats count AS Serial

[woodcock]

That it does.