Splunk Search

validate access to knowledge object

efaundez
Path Finder

Good afternoon

I am trying to perform an audit of the environmental lookups and I need to know if there is any query that allows to validate whether this knowledge object is being used or accessed

Any information is appreciated

Best regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not trivial. Start by searching all of your savedsearches.conf files for the lookup file name. Then search _internal for accesses to those searches.
Then search all of your macros.conf files for the lookup file name. Find out where those macros are used then search _internal for those searches.
Finally (if I didn't forget something), search all of your dashboards for the lookup file name then search _internal for accesses to those dashboards.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...