Came here to find this answer, but you need to beware the mangling of the btool output is wrong from the command listed in the answer;
./splunk cmd btool savedsearches list --debug | grep "etc/apps/search" | sed -r 's/^(\S+\s+)//'
Several chunks of the output have line breaks in the content output, and so grepping for the path gets only the first line of any field. In particular, searches often have line breaks.
You'd be better off just outputting the whole of
./splunk cmd btool savedsearches list --debug
and then manually grabbing just the section you need, then doing a search replace to remove the path.
If you just want to count objects etc, then the original will work fine. But if you need the actual contents, be careful with greps and seds unless you know what you're doing and check the formats of the source.
It also somewhat misinterprets the btool output. If you look at the raw output, it's clear any given saved search is compiled from layers of defaulting, which btool shows, with the path. What worked for me was using fgrep to exclude specific, noisy defaults. In particular;
./splunk cmd btool savedsearches list --debug | fgrep -v "etc/system/default" | fgrep -v display.visualizations.custom >>>>
So, that's basically the raw, minus the defaults across the whole system, minus the paragraphs of settings added by each of the custom viz apps installed that mysteriously get added to every search.
Removing the path at the beginning can be done with a smarter sed than just "something then some spaces, convert to nothing". That will tend to trim the first anyting on the line, which, for saved searches is going to kill a lot of content. something like
cat savedsearchbtool.conf | sed -r 's/\/opt\/splunk\/etc[\/a-z0-9A-Z\-_.]+savedsearches.conf\s+//'
BUT, I'd do the trimming first. Get filtered output with the paths. Manually trim. Then strip the paths.
... View more