This search has been a life saver. Thank you so very much @dmarling. I have updated the search slightly using rex to deal with any spaces and double quotes eg. index = "main". This search assumes your index name consists of alphabets and underscores only. Modify rex as necessary. | union [| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" | rex field="eai:data" max_match=0 "index\s*=\s*\"*(?<indexes_used>[_a-zA-Z]*)" | search indexes_used=main | eval Type="Dashboards" | search title=indian_h2h_carriers_tpr_utilization_prototype | table Type title eai:acl.app author eai:acl.sharing eai:acl.perms.read eai:acl.perms.write] [| rest splunk_server="local" "/servicesNS/-/-/saved/eventtypes" | rex field=search max_match=0 "index\s*=\s*\"*(?<indexes_used>[_a-zA-Z]*)" | search indexes_used=main | eval Type="Eventtypes" | table Type title eai:acl.app author eai:acl.sharing eai:acl.perms.read eai:acl.perms.write] [| rest splunk_server="local" "/servicesNS/-/-/data/ui/panels" | rex field="eai:data" max_match=0 "index\s*=\s*\"*(?<indexes_used>[_a-zA-Z]*)" | search indexes_used=main | eval Type="Panels" | table Type title eai:acl.app author eai:acl.sharing eai:acl.perms.read eai:acl.perms.write] [| rest splunk_server="local" "/servicesNS/-/-/admin/macros" | rex field=definition max_match=0 "index\s*=\s*\"*(?<indexes_used>[_a-zA-Z]*)" | search indexes_used=main | eval Type="Macros" | table Type title eai:acl.app author eai:acl.sharing eai:acl.perms.read eai:acl.perms.write] [| rest splunk_server="local" "/servicesNS/-/-/data/models" | rex field="eai:data" max_match=0 "index\s*=\s*\"*(?<indexes_used>[_a-zA-Z]*)" | search indexes_used=main | eval Type="Data Models" | table Type title eai:acl.app author eai:acl.sharing eai:acl.perms.read eai:acl.perms.write] [| rest splunk_server="local" "/servicesNS/-/-/saved/searches" | rex field="search" max_match=0 "index\s*=\s*\"*(?<indexes_used>[_a-zA-Z]*)" | search indexes_used=main | eval Type="Saved Searches/Alerts/Reports" | table Type title eai:acl.app author eai:acl.sharing eai:acl.perms.read eai:acl.perms.write]
... View more
