Find what is using a lookup table.

[JJCO]

I've got a question about lookup tables, and how to audit them.

I have a rather large lookup table that's being recreated daily from a scheduled correlation search.
I don't know if any other correlation searches or anything is actually using that lookup table.

I wanted to see if there was a way to audit it's use so I can delete the table, and remove the correlation search if needed.

[livehybrid · Accepted solution]

Hi @JJCO 

To audit the usage of a lookup table in Splunk, you can search the search logs to find any queries using it.

Use the following SPL to search for references to your lookup table:

index=_audit action=search info=completed search="*your_lookup_table_name*"

Replace your_lookup_table_name with the actual name of your lookup table.

This will show you any search queries that include your lookup table, indicating its usage.

For more details, you can refer to Splunk's documentation on auditing: Audit Logs in Splunk

This should help you determine if the lookup table is being utilized elsewhere.

🌟Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[isoutamo]

You should remember that there are another way to use that lookup table than just "add" it's name into your search!

It can be used as automatic lookup, via lookup command, input/outputlookup and even DMs can use it. For that reason you need to dig this little bit deeper to get all those usages. I'm not 100% sure if all those are reported into _audit log or not (I expecting that not)? It could even need that you somehow look users' search.log to see how splunk has expanded e.g. automatic lookups etc.