Splunk Search

how to find index names from Splunk saved searches

arrangineni
Path Finder

How to find the indexes that the saved searches are running against? Few of my searches are not using index names within saved searches.

Tags (1)
0 Karma

cmerriman
Super Champion

Thanks @woodcock

try this query:

| rest splunk_server=* /servicesNS/-/-/saved/searches f=title f=eai:acl* f=description f=qualifiedSearch f=next_scheduled_time search="eai:acl.app!=splunk_archiver" search="eai:acl.app!=splunk_app_windows_infrastructure" search="eai:acl.app!=splunk_app_aws" search="eai:acl.app!=nmon"
| table splunk_server title, eai:acl.owner, description, eai:acl.app, qualifiedSearch, next_scheduled_time | search next_scheduled_time!="" qualifiedSearch!="*index IN*"
| regex qualifiedSearch!=".*index\s*(!?)=\s*([^*]|\*\S+)" 
| regex qualifiedSearch="^\s*search "
| regex qualifiedSearch!="^\s*search\s*\[\s*\|\s*inputlookup"
| rex field=qualifiedSearch "^(?P<exampleQueryToDetermineIndexes>[^\|]+)"
|rex field=exampleQueryToDetermineIndexes max_match=0 "eventtype=(?<eventtype>[^\s]+)"
|join eventtype splunk_server type=left [|rest /services/admin/eventtypes splunk_server=* f=search f=title|table splunk_server title search|rename title as eventtype search as eventtype_def]
|eval eventtype="eventtype=".eventtype|eval exampleQueryToDetermineIndexes=if(like(exampleQueryToDetermineIndexes,"%eventtype%"),replace(exampleQueryToDetermineIndexes,eventtype,eventtype_def),exampleQueryToDetermineIndexes)
|replace *eventtype* with *eventtype_def* in exampleQueryToDetermineIndexes
| regex exampleQueryToDetermineIndexes!="\`"
| regex exampleQueryToDetermineIndexes!=".*index\s*(!?)=\s*([^*]|\*\S+)" | regex exampleQueryToDetermineIndexes!=".*tag\s*(!?)=\s*([^*]|\*\S+)" 
|where isnotnull(exampleQueryToDetermineIndexes)
|fields - eventtype eventtype_def
| rename eai:acl.owner AS owner, eai:acl.app AS Application
|stats values(*) as * by Application title

It actually comes from https://splunkbase.splunk.com/app/3796/ , if I recall correctly - we adjusted it slightly in our environment, but I think this is the original search.

woodcock
Esteemed Legend

It is EXTREMELY poor practice to search without specifying index values. When you do, the same search will behave differently for different users and also for the same users across time (whenever your Splunk admin decides to modify roles). You can see what your user is searching now like this:

| tstats count WHERE earliest=0 BY index
0 Karma

arrangineni
Path Finder

Thanks for the response @woodcock what I am also looking for is to identify index names defined in the search queries of saved searches. I am using below rest call to get the qualifiedSearch field from the saved searches using REST API and trying to extract index names out of it

| rest /servicesNS/-/-/saved/searches
| table title, eai:acl.owner, description, eai:acl.app, qualifiedSearch, next_scheduled_time

0 Karma

woodcock
Esteemed Legend

this is WAY harder than it seems. I believe that @cmerriman did some work on this.

0 Karma

arrangineni
Path Finder

tried doing the rex for index name but seems it needs more fine tuning
| rex field=qualifiedSearch "index=(?.\w+)"

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...