how can i see all of the searches that are looking for a specific field?

[matt]

We are making some changes to our system which requires a field name in the raw event to be changed. We'd like to know the impact to all our users' searches and dashboards that make reference to the field. Is there a way to get an inventory of all the saved searches and dashboards with the field foo in the search string?

[landen99]

The first search of the accepted answer has dashboard formatting in the regex (gt/lt) not conducive to the search line and also could benefit from using the regex command to filter:

|rest /servicesNS/-/-/data/ui/views  splunk_server=local | regex eai:data="query" | table author eai:acl.app id eai:data title label|rex max_match=0 field=eai:data "\<query\> *(?P<search_used>[^\<]+)\<\/query\>" | search search_used=* | mvexpand search_used

followed by: | regex search_used="." | fields - eai:data

Where the dot in the regex command is replaced by the fieldname token.

While it is crude to search for the name without the field usage format/context, it will work for most cases. More effort to key on field usage context would produce more accurate results.

[Flynt · Accepted solution]

You can search the in-line searches used in public views for a particular field by running the following -

 |rest /servicesNS/-/-/data/ui/views  splunk_server=local |table author eai:acl.app id eai:data title label|rex max_match=0 field=eai:data "\<query\>(?P<search_used>.*)\<\/query\>"|search search_used!=""|mvexpand search_used|fields - eai:data |table *|search search_used="*DESIREDFIELD*"

This will list all public views and their respective searches. Notice that we are only asking for the views on the LOCAL instance. If you want to search all views in all search heads remove splunk_server=local

To search public saved searches for a particular field -

|rest /servicesNS/-/-/saved/searches |fields author title qualifiedSearch |eval qualifiedSearch=lower(qualifiedSearch) |search qualifiedSearch="*DESIREDFIELD*"