Splunk Search

Is there a way to tell if a "specific" lookup file is in use on a dashboard, report, or alert without manually checking each of these searches?

Explorer

found the answer to getting all lookup files in use on a dashboard, report or alert. Looking for a way to tell if one specific lookup file is being used.

thank you,

1 Solution

Builder

You can use the rest endpoint to search all saved searches for any that contain a reference the specified lookup:

| rest /servicesNS/-/-/saved/searches splunk_server=local  | search qualifiedSearch=*lookupname*

View solution in original post

Builder

You can use the rest endpoint to search all saved searches for any that contain a reference the specified lookup:

| rest /servicesNS/-/-/saved/searches splunk_server=local  | search qualifiedSearch=*lookupname*

View solution in original post

Explorer

thank you so much! this did the trick!

0 Karma

Explorer

is there a way to also include the app? say all reports/dashboards/datasets that are owned by a specific app?

thank you!

0 Karma

Builder

| search qualifiedSearch=lookupname eai:acl.app=$YOUR_APP$

0 Karma