Dashboards & Visualizations

Why is my Splunk REST API Saved Searches Query not handling namespace parameter?

awwong2
New Member

(I am currently using Splunk 6.3.3 if that matters.)

Looking at the JavaScript documentation andit appears that I should be able to filter saved searches based on owner, app, and sharing.

I have three saved searches defined in an application:

  • alt text

However, when I attempt to get only these searches in the JavaScript & REST API, I see a list of globally shared searches for a variety of different applications:

# Some Javascript...

const splunkConfig = {
  # username, password, etc. for the ohd user
}
const service = new splunkjs.Service(splunkConfig);
const savedSearches = service.savedSearches({owner: "ohd", app: "dev_ohd", sharing: "user"});
savedSearches.fetch(function (err, savedSearches) {
  for (let i = 0; i < savedSearches.list().length; i++) {
    let searchInstance = savedSearches.list()[i];
    console.log(searchInstance.name);
    console.log(searchInstance.namespace);
  }
});

When run this, the above code prints out the following:

... # correct owner, wrong app, wrong sharing
ohd_full_scom_data
{ owner: 'ohd', app: 'search', sharing: 'global' }

# correct owner, app, and sharing
...
ohd_aserv_summary
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
ohd_azure_drilldown
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
ohd_azure_summary
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }

# wrong owner, app, and sharing
...
ohd_scom_metric_history
{ owner: 'kevwang', app: 'search', sharing: 'global' }
ohd_splunk_usage
{ owner: 'ohd',
  app: 'splunk_management_console',
  sharing: 'global' }
Per-Panel Filtering - Activity By User Over Time
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Recent Activity
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Top Users
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
...

Is there something obvious that I am missing? Using the REST API through splunk_instance_ip:8089/servicesNS/ohd/dev_ohd/saved/searches the same problem exists.

0 Karma

jkat54
SplunkTrust
SplunkTrust

This is the expected behavior. You're seeing searches that are shared globally, which means they effectively do not have an app context.

In your screen shot you have "this apps" selected as your filter, if you select "all" you'll see the other searches there as well.

I think you can use this pagination and filter option to get exactly what you're looking for though:

request.ui_dispatch_app

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTprolog#Pagination_and_filtering_parame...
http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTsearch#GET_saved.2Fsearches_method_det...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...