Identify all saved searches that use a specific keyword

Description:

This Splunk search searches all your saved searches for a specific keyword. Handy if you need to identify all searches that use a specific index, sourcetype or other keyword.

 

Query:

|rest  /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| rename eai:acl.app AS app
| rename eai:acl.app AS app
| search qualifiedSearch=*keyword*
| table title, cron_schedule, author, app, eai:acl.owner, orphan, disabled, is_scheduled, qualifiedSearch id
Share This:
Tagged:

Leave A Comment?