Splunk Dev

REST query for saved searches only returns owner="nobody" results

the4tress
Engager

I am trying to build an application that leverages our Splunk Enterprise
setup using Python. I want to get a list of all saved searches (reports),
then get a list of the results of those searches. When I connect to Splunk
via the API and query for saved searches it only returns searches owned by
"nobody", but when I view the searches in the Web UI I see all the searches
saved by everybody.

How can I view the searches saved by everybody, or even a specific user?

Here is a very basic version of what I'm trying to do:

import splunklib.client as client
import splunklib.results as results

CONNECT_DICT = {
    'username': removed,
    'password': removed,
    'host': removed,
    'port': removed
}

service = client.connect(**CONNECT_DICT)

saved_searches = service.saved_searches

for saved_search in saved_searches:
    print "%s: %s" % (saved_search.name, saved_search['search'])

Thanks for any info.

Tags (2)
0 Karma
1 Solution

strive
Influencer

By default the API returns the saved searches present in current namespace. See this link http://dev.splunk.com/view/python-sdk/SP-CAAAEK2#listsaved the section "To list saved searches" will help you to retrieve what you need. You should create a separate service class.

for overview on namespaces read this. http://dev.splunk.com/view/python-sdk/SP-CAAAEBB#namespaces

View solution in original post

strive
Influencer

By default the API returns the saved searches present in current namespace. See this link http://dev.splunk.com/view/python-sdk/SP-CAAAEK2#listsaved the section "To list saved searches" will help you to retrieve what you need. You should create a separate service class.

for overview on namespaces read this. http://dev.splunk.com/view/python-sdk/SP-CAAAEBB#namespaces

the4tress
Engager

Thanks @strive. That got me one step closer. I'm having permissions issues on my service account now. It doesn't have permission to access other user's saved searches.

I posted the question here: http://answers.splunk.com/answers/149067/permissions-issue-access-saved-searches

0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...