Splunk Search

Is there a way to tell if a "specific" lookup file is in use on a dashboard, report, or alert without manually checking each of these searches?

Explorer

found the answer to getting all lookup files in use on a dashboard, report or alert. Looking for a way to tell if one specific lookup file is being used.

thank you,

1 Solution

Builder

You can use the rest endpoint to search all saved searches for any that contain a reference the specified lookup:

| rest /servicesNS/-/-/saved/searches splunk_server=local  | search qualifiedSearch=*lookupname*

View solution in original post

Builder

You can use the rest endpoint to search all saved searches for any that contain a reference the specified lookup:

| rest /servicesNS/-/-/saved/searches splunk_server=local  | search qualifiedSearch=*lookupname*

View solution in original post

Explorer

thank you so much! this did the trick!

0 Karma

Explorer

is there a way to also include the app? say all reports/dashboards/datasets that are owned by a specific app?

thank you!

0 Karma

Builder

| search qualifiedSearch=lookupname eai:acl.app=$YOUR_APP$

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!