Created
June 17, 2019 16:19
-
-
Save faststeak/e30f6802fd51c3cd325e6b4247e85267 to your computer and use it in GitHub Desktop.
Splunk search to find Accelerated Data Models that are using a lookup
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## Any DMs returned are using a lookup, so those lookups need to be on the indexers. | |
| | rest splunk_server=local /services/datamodel/acceleration| fields title search | eval contains_lookup=if(like(search, "%lookup%"),1,0) | eval contains_lookup=case(contains_lookup=1,"yes",contains_lookup=0,"no")| table title search contains_lookup | search contains_lookup=yes |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment