Is there a way to tell if a "specific" lookup file is in use on a dashboard, report, or alert without manually checking each of these searches?

[owie6466]

found the answer to getting all lookup files in use on a dashboard, report or alert. Looking for a way to tell if one specific lookup file is being used.

thank you,

[solarboyz1 · Accepted solution]

You can use the rest endpoint to search all saved searches for any that contain a reference the specified lookup:

| rest /servicesNS/-/-/saved/searches splunk_server=local  | search qualifiedSearch=*lookupname*

[owie6466]

thank you so much! this did the trick!

[owie6466]

is there a way to also include the app? say all reports/dashboards/datasets that are owned by a specific app?

thank you!

[solarboyz1]

| search qualifiedSearch=lookupname eai:acl.app=$YOUR_APP$