My main goal is to go to all locations and make sure that the SPL that is being used along with index=<my_index> is actually doing what it should because the data changed from csv format to json. And the field value pairs changed their naming convention. All because our environment chose to change the application it uses to gather said data. I have been tasked with this and I was not even the person who created all these searches/reports/alerts etc... So no tribal knowledge which led me to this forum.  ... View more

I have similar issue. The data we had coming into one of our indexes, has now switched to a different format and slightly different field/value pairs. Now I am tasked with finding, where this index/data is being used in lookups, reports, alerts, etc.... So we can change the SPL To match the new data.  ... View more