Is there a way to tell if a lookup file is in use on a dashboard, report, or alert without manually checking each of these searches?

[pepper_seattle]

I employ a fair number of lookup files across my app which is heavily populated with dashboards and reports.

Question:
Is there a way to tell if a lookup file is in use on a dashboard, report, or alert without manually checking each of these areas/queries?

[MuS · Accepted solution]

Hi pepper_seattle,

This is hard to tell, because what if your lookup is setup as automatic lookup on a sourcetype? Then you would have to check all searches and see if they use the lookup by searching for events for this sourcetype. For example, of these searches which one makes use of a user-to-location lookup on sourcetype=bar?

sourcetype=b* | table *
sourcetype=foo | stats count by location
index=baz | stats count by location

• Search 1 may return events matching the stanza, but there's no indication that it returns the location field
• Search 2 obviously uses the location field but can't return events matching the sourcetype
• Search 3 may or may not even have matching events in that index

One other thing would be if all search uses inputlookup or lookup which will be much easier to tell by looking at the searches.

Hope this helps ...

cheers, MuS

[pepper_seattle]

Mainly looking to see any saved query (in a dashboard, alert, or report) that would include "..| lookup .."

Does that make it simpler?

[MuS]

Much simpler 😉 try this search in your Splunk App:

 | rest /services/saved/searches | search qualifiedSearch=*lookup* | table title

This will list all saved searches which contain lookup. Run this command to get back all dashboards containing lookup:

| rest /servicesNS/-/-/data/ui/views | search eai:data=*lookup* | table title

Hope this helps ...