Reporting

How do I list all the saved searches for an App in Splunk with rest?

drdosia
Explorer

I have tried this:
| rest /services/saved/searches | table title search
I got only 36 results.
I then tried
| rest /services/saved/searches | table ***
to see all the fields.

**eai:acl.app
matches what should show the Splunk App that the saved searches come from.
I got 36 results and eai:acl.app had "search" for all 36 of them. They match the saved searches in the search App.
I was running this as an id with the Admin role that should see all Apps.
I have over 100 Apps with anywhere from 3 to 70 saved searches each.
It does not matter that I am in any particular App (context). I get the same results only showing the 36 from the search App.
How do I list the saved searches from one (or more) of the other Apps?

This is on version 5.03

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll want the servicesNS REST endpoints, like this:

| rest /servicesNS/-/your_app/saved/searches

| rest /servicesNS/your_user/your_app/saved/searches

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You'll want the servicesNS REST endpoints, like this:

| rest /servicesNS/-/your_app/saved/searches

| rest /servicesNS/your_user/your_app/saved/searches

drdosia
Explorer

Follow-up
The answer by martin_Muller works, but be aware that you need to be logged in as a user that has access to Your_app
| rest /servicesNS/Your_user/Your_app/saved/searches | table eai:acl.app author title search

Note, unless you are an admin role you will not see the "private" non-shared saved searches

Many thanks to martin_mueller for a quick answer!

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...