Hello,
I can only save searches as private reports (user restrictions) with the web interface. These reports appear along with those created publicly by other users as follows:
Title Owner App Sharing
Errors in the last 24 hours nobody search App
Errors in the last hour nobody search App
License Usage Data Cube nobody search App
TServers_Requests myuser search Private
Videolibrary_Requests myuser search Private
(Sorry for the formatting, but I don't know how to make tables with markdown)
Now I want to access those reports via the REST API, but when i make
curl -k -u myuser:passwd https://192.168.1.100:8089/servicesNS/myuser/search/saved/searches
the only ones I see are the first three.
How can I see my private searches?
Thanks in advance.
No wonder why nobody answered this: it was a problem of the configuration of my company's Splunk. It seems we have 2 searchers: one exposes the web and the other the API, and they don't share the reports, so, what you make in the web is not shown in the API (I will have to find why did they configure it that way, because it makes no sense)
Well, sorry to bother you guys with this question (that can be closed), but i didn't know this configuration.