Splunk Search

Lookup table question

myoung54
Explorer

Hello all,

I searched around for quite a while and I couldn't find an answer to this, so I figured I'd just ask. My organization has dozens upon dozens of lookup tables, and I was wondering if there was a way to see what specific lookup tables a given dashboard is using?

Being that my organization has so many lookup tables, it can be hard to know which one needs editing because you can't tell what's in use and what's a duplicate.

0 Karma
1 Solution

arjunpkishore5
Motivator

The rest endpoint /data/ui/views provides all dashboard definitions. Assuming that SPL is in the dashboard and not within a saved search, you can use this.

| rest servicesNS/-/-/data/ui/views 
| rename eai:acl.app as app, eai:data as data 
| rex field="data" max_match=0 "\|\s*(input|output)?lookup\s*(?<lookup_file>\S+)" 
| search lookup_file=* 
| table app, title, lookup_file 
| mvexpand lookup_file

Some cleanup might be required on the file names, but this should get you started.

Hope this helps. Please mark as answer if this is what you were looking for.

Cheers!

View solution in original post

0 Karma

woodcock
Esteemed Legend
0 Karma

arjunpkishore5
Motivator

The rest endpoint /data/ui/views provides all dashboard definitions. Assuming that SPL is in the dashboard and not within a saved search, you can use this.

| rest servicesNS/-/-/data/ui/views 
| rename eai:acl.app as app, eai:data as data 
| rex field="data" max_match=0 "\|\s*(input|output)?lookup\s*(?<lookup_file>\S+)" 
| search lookup_file=* 
| table app, title, lookup_file 
| mvexpand lookup_file

Some cleanup might be required on the file names, but this should get you started.

Hope this helps. Please mark as answer if this is what you were looking for.

Cheers!

0 Karma

myoung54
Explorer

This is exactly what I was looking for, thank you!!

0 Karma

marycordova
SplunkTrust
SplunkTrust

Is this the kind of dashboard panel you can open with the magnifying glass to view the SPL? The lookup tables might be discernible there.

@marycordova
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...