We have a business need to document all reporting deliverables and I'd prefer to automate as much of it as possible. I'm looking for options to pull information out of savedsearches.conf across all apps/all search heads. Need to be able to retrieve things like the search name, the search syntax, schedule, earliest/latest timeframes, and e-mail action details. In a perfect world, I could also cross reference it with the metadata about who created/owned the search and related permissions.
Is this something that I can do within Splunk using metadata or other self-reporting tools? Or do I need to set up a new inputs to monitor all splunk/etc/apps///saavedsearches.conf locations in order to grab this information? Or is there some other preferred option?
