The Splunk API appears to be limiting the number of "saved searches" returned. I am running the query with our admin account so I do not believe it is a permissions issue. However, I did notice if I adjust a query to GLOBAL it appears to show up in the list.
Is there not a way to show ALL saved searches?
Example query:
curl -k -u admin:$PASS "splunk:8089/servicesNS/admin/search/saved/searches?count=100"
curl -k -u admin:$PASS "splunk:8089/services/saved/searches?count=100"
Thanks!
I found the answer to my question:
"splunk:8089/servicesNS/-/-/saved/searches?count=100"
I do not know why this is not included in the documentation as it clearly states, "List all saved searched on this Splunk instance" for the below command.
curl -k -u admin:pass "localhost:8089/services/saved/searches"