Splunk Search

validate access to knowledge object

efaundez
Path Finder

Good afternoon

I am trying to perform an audit of the environmental lookups and I need to know if there is any query that allows to validate whether this knowledge object is being used or accessed

Any information is appreciated

Best regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not trivial. Start by searching all of your savedsearches.conf files for the lookup file name. Then search _internal for accesses to those searches.
Then search all of your macros.conf files for the lookup file name. Find out where those macros are used then search _internal for those searches.
Finally (if I didn't forget something), search all of your dashboards for the lookup file name then search _internal for accesses to those dashboards.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...