Reporting

How do I list all the saved searches for an App in Splunk with rest?

drdosia
Explorer

I have tried this:
| rest /services/saved/searches | table title search
I got only 36 results.
I then tried
| rest /services/saved/searches | table ***
to see all the fields.

**eai:acl.app
matches what should show the Splunk App that the saved searches come from.
I got 36 results and eai:acl.app had "search" for all 36 of them. They match the saved searches in the search App.
I was running this as an id with the Admin role that should see all Apps.
I have over 100 Apps with anywhere from 3 to 70 saved searches each.
It does not matter that I am in any particular App (context). I get the same results only showing the 36 from the search App.
How do I list the saved searches from one (or more) of the other Apps?

This is on version 5.03

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll want the servicesNS REST endpoints, like this:

| rest /servicesNS/-/your_app/saved/searches

| rest /servicesNS/your_user/your_app/saved/searches

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You'll want the servicesNS REST endpoints, like this:

| rest /servicesNS/-/your_app/saved/searches

| rest /servicesNS/your_user/your_app/saved/searches

drdosia
Explorer

Follow-up
The answer by martin_Muller works, but be aware that you need to be logged in as a user that has access to Your_app
| rest /servicesNS/Your_user/Your_app/saved/searches | table eai:acl.app author title search

Note, unless you are an admin role you will not see the "private" non-shared saved searches

Many thanks to martin_mueller for a quick answer!

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...