Splunk Dev

How to show enabled or disabled number of saved searches w.r.t. hosts irrespective of time range?

jhantuSplunk
New Member

to show enabled or disabled number of saved searches w.r.t. hosts irrespective of time range in Splunk?

Tags (1)
0 Karma

jconger
Splunk Employee
Splunk Employee

This search may be what you want:

| rest /services/saved/searches | table title disabled splunk_server search

alt text

jhantuSplunk
New Member

I want do this by using index not rest

0 Karma

jconger
Splunk Employee
Splunk Employee

I'm not quite sure what you mean when you state "...using index...". Data about saved searches is not kept in an index. The search I posted above will give you information about saved searches though. I added a screenshot to the original answer to see an example.

0 Karma

vya9836
New Member

How do i need to get a report created on search head for the network/modular inputs which are created on a Heavy Forwarder using rest Api command.

0 Karma

vya9836
New Member

How do i need to get a report created on search head for the network/modular inputs which are created on a Heavy Forwarder using rest Api command.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...