How do I search for a list of Saves searches that don't use index name for searching in Splunk Ent. or ES. Thank u a lot

[SamHTexas]

I need to find a list of saved searches that don't use the index name in searching please. Any way to list the name of the users with this list, any cool SPLs ? Thank u in advance. Much appreciated.

[PickleRick]

What do you mean "don't use an index"? You can quite easily find searches which don't have said index literarily entered as a part of the search but what if the searches reference that index in another way? A macro, for example. Or a subsearch?

BTW, just because a search doesn't use a "index=something" condition, doesn't mean that it's "bad". You might - for example have searches populating lookups by performing ldapsearch. Or you might use a search to check a dynamicaly created lookup for its validity of some kind. Or any other legit reason not to have an index explicitly included i  the search.

[codebuilder]

Try this:

| rest /servicesNS/-/-/saved/searches | search search!=*index* |table search eai:acl.owner is_scheduled

[SamHTexas]

Thx bro for your reply. From your point of view what issues do u see if a search is not using an Index name? Am looking from a Security point of view? Thanks again.

[isoutamo]

Probably the biggest issue is that you didn’t know which indexes the query is using (or better to say which it should use). As @PickleRick @said there are many ways to define which index it should use other than index=abc (e.g. eventtypes, auth config files, macros etc.). As those can changed time by time, you couldn’t know later on which indexes are used (should use) by querying that from logs.

r. Ismo