Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Lookup table question
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all,
I searched around for quite a while and I couldn't find an answer to this, so I figured I'd just ask. My organization has dozens upon dozens of lookup tables, and I was wondering if there was a way to see what specific lookup tables a given dashboard is using?
Being that my organization has so many lookup tables, it can be hard to know which one needs editing because you can't tell what's in use and what's a duplicate.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The rest endpoint /data/ui/views provides all dashboard definitions. Assuming that SPL is in the dashboard and not within a saved search, you can use this.
| rest servicesNS/-/-/data/ui/views
| rename eai:acl.app as app, eai:data as data
| rex field="data" max_match=0 "\|\s*(input|output)?lookup\s*(?<lookup_file>\S+)"
| search lookup_file=*
| table app, title, lookup_file
| mvexpand lookup_file
Some cleanup might be required on the file names, but this should get you started.
Hope this helps. Please mark as answer if this is what you were looking for.
Cheers!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Take a look at this Q&A:
https://answers.splunk.com/answers/329645/is-there-a-programmatic-method-to-list-and-analyze.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The rest endpoint /data/ui/views provides all dashboard definitions. Assuming that SPL is in the dashboard and not within a saved search, you can use this.
| rest servicesNS/-/-/data/ui/views
| rename eai:acl.app as app, eai:data as data
| rex field="data" max_match=0 "\|\s*(input|output)?lookup\s*(?<lookup_file>\S+)"
| search lookup_file=*
| table app, title, lookup_file
| mvexpand lookup_file
Some cleanup might be required on the file names, but this should get you started.
Hope this helps. Please mark as answer if this is what you were looking for.
Cheers!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is exactly what I was looking for, thank you!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is this the kind of dashboard panel you can open with the magnifying glass to view the SPL? The lookup tables might be discernible there.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
