Recently cluster="*M5*-CLDB" changed this to cluster="*ML*-CLDB"

[bmanikya]

Would like to run a scan on backend and look for "*M5*-CLDB" or any combination of M5 and CLDB. We have Splunk Distributed environment, indexer and search head clusters. Saved searches, lookups, Dashboards which needs to be modified due to the cluster name change. Could someone share your thoughts on the same.

[etoombs]

You can start out doing this in Splunk. Expand on the configs you want to look for in the search below, and then after you've pulled all of the configs you care about from rest endpoints, run a search for the keyword you're looking for in it.   You can find a list of configuration files here: https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Listofconfigurationfiles

| rest/services/configs/conf-macros
| eval config="macros"
| append
[| rest/services/configs/conf-lookups
| eval config="lookups"]
| append
[| rest/services/configs/conf-savedsearches
| eval config="searches"]

You can add in views and such using other endpoints, like | rest /services/data/ui/views