Splunk Search

How to check which lookup file or table have have an specific field

junier16
Explorer

im looking for the field "is_prohibited=true". This is field is located in one of lookup table, event type, or tag. How can i find out where that filed is  located ?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @junier16,

at a first sight it seems to be an eventtype, anyway you can search:

  • eventtypes and tags in [Settings -- Eventtypes],
  • for lookups see in [Settings -- Lookups -- Definitions],

for both there's a dedicated search function (remeber to remove the filters on top).

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...