Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Size of All Lookup Files on Search Head Copy


				| rest /servicesNS/-/-/data/transforms/lookups getsize=true
| fields splunk_server filename title type size eai:appName

0 comments

[0]

Splunk Search for Size of Lookup File Copy


				| rest /servicesNS/-/-/data/transforms/lookups getsize=true
| fields splunk_server filename title type size eai:appName
| search filename="<insert lookup file name>"

0 comments

[0]

Splunk Search for ITSI Entities Associated With Each Service Copy


				| inputlookup service_kpi_lookup | fields _key title | rename _key as key | lookup itsi_entities services._key as key OUTPUT _itsi_identifier_lookups as identifiers

0 comments

[0]

Splunk Search for ITSI Services Without Dependencies Copy


				| inputlookup service_telemetry_lookup | fields title services_depends_on.serviceid | rename services_depends_on.serviceid as dependencies  | eval dependencies=mvjoin(dependencies,",") | where isnull(dependencies)

0 comments

[0]