Dashboards & Visualizations

Why is my Splunk REST API Saved Searches Query not handling namespace parameter?

awwong2
New Member

(I am currently using Splunk 6.3.3 if that matters.)

Looking at the JavaScript documentation andit appears that I should be able to filter saved searches based on owner, app, and sharing.

I have three saved searches defined in an application:

  • alt text

However, when I attempt to get only these searches in the JavaScript & REST API, I see a list of globally shared searches for a variety of different applications:

# Some Javascript...

const splunkConfig = {
  # username, password, etc. for the ohd user
}
const service = new splunkjs.Service(splunkConfig);
const savedSearches = service.savedSearches({owner: "ohd", app: "dev_ohd", sharing: "user"});
savedSearches.fetch(function (err, savedSearches) {
  for (let i = 0; i < savedSearches.list().length; i++) {
    let searchInstance = savedSearches.list()[i];
    console.log(searchInstance.name);
    console.log(searchInstance.namespace);
  }
});

When run this, the above code prints out the following:

... # correct owner, wrong app, wrong sharing
ohd_full_scom_data
{ owner: 'ohd', app: 'search', sharing: 'global' }

# correct owner, app, and sharing
...
ohd_aserv_summary
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
ohd_azure_drilldown
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
ohd_azure_summary
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }

# wrong owner, app, and sharing
...
ohd_scom_metric_history
{ owner: 'kevwang', app: 'search', sharing: 'global' }
ohd_splunk_usage
{ owner: 'ohd',
  app: 'splunk_management_console',
  sharing: 'global' }
Per-Panel Filtering - Activity By User Over Time
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Recent Activity
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Top Users
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
...

Is there something obvious that I am missing? Using the REST API through splunk_instance_ip:8089/servicesNS/ohd/dev_ohd/saved/searches the same problem exists.

0 Karma

jkat54
SplunkTrust
SplunkTrust

This is the expected behavior. You're seeing searches that are shared globally, which means they effectively do not have an app context.

In your screen shot you have "this apps" selected as your filter, if you select "all" you'll see the other searches there as well.

I think you can use this pagination and filter option to get exactly what you're looking for though:

request.ui_dispatch_app

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTprolog#Pagination_and_filtering_parame...
http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTsearch#GET_saved.2Fsearches_method_det...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...