Splunk Searches | A collection of useful Splunk SPL

Splunk Search for Size of All Lookup Files on Search Head Copy


				| rest splunk_server=local /servicesNS/-/-/data/lookup-table-files
| fields title eai:acl.owner eai:acl.app
| where !match(title,"\.mlmodel")
| rename eai:acl.* as *
| map
    [ | inputlookup $title$ | foreach *
        [ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
    | addtotals b_* fieldname=b
    | stats sum(eval(b/1024/1024)) as mb
    | eval name="$title$", owner="$owner$", app="$app$" ] maxsearches=1000

0 comments

[0]

Splunk Search for Size of Lookup File Copy


				| inputlookup <insert lookup file name>
| foreach *
    [ | eval b_<<FIELD>>=len(<<FIELD>>) + 1 ]
| addtotals b_* fieldname=b
| stats sum(b) as b
| eval mb=b/1024/1024, gb=mb/1024
| fields b mb gb

0 comments

[0]

Splunk Search for ITSI Entities Associated With Each Service Copy


				| inputlookup service_kpi_lookup | fields _key title | rename _key as key | lookup itsi_entities services._key as key OUTPUT _itsi_identifier_lookups as identifiers

0 comments

[0]

Splunk Search for ITSI Services Without Dependencies Copy


				| inputlookup service_telemetry_lookup | fields title services_depends_on.serviceid | rename services_depends_on.serviceid as dependencies  | eval dependencies=mvjoin(dependencies,",") | where isnull(dependencies)

0 comments

[0]