(I am currently using Splunk 6.3.3 if that matters.)
Looking at the JavaScript documentation andit appears that I should be able to filter saved searches based on owner, app, and sharing.
I have three saved searches defined in an application:
However, when I attempt to get only these searches in the JavaScript & REST API, I see a list of globally shared searches for a variety of different applications:
# Some Javascript...
const splunkConfig = {
# username, password, etc. for the ohd user
}
const service = new splunkjs.Service(splunkConfig);
const savedSearches = service.savedSearches({owner: "ohd", app: "dev_ohd", sharing: "user"});
savedSearches.fetch(function (err, savedSearches) {
for (let i = 0; i < savedSearches.list().length; i++) {
let searchInstance = savedSearches.list()[i];
console.log(searchInstance.name);
console.log(searchInstance.namespace);
}
});
When run this, the above code prints out the following:
... # correct owner, wrong app, wrong sharing
ohd_full_scom_data
{ owner: 'ohd', app: 'search', sharing: 'global' }
# correct owner, app, and sharing
...
ohd_aserv_summary
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
ohd_azure_drilldown
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
ohd_azure_summary
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
# wrong owner, app, and sharing
...
ohd_scom_metric_history
{ owner: 'kevwang', app: 'search', sharing: 'global' }
ohd_splunk_usage
{ owner: 'ohd',
app: 'splunk_management_console',
sharing: 'global' }
Per-Panel Filtering - Activity By User Over Time
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Recent Activity
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Top Users
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
...
Is there something obvious that I am missing? Using the REST API through splunk_instance_ip:8089/servicesNS/ohd/dev_ohd/saved/searches the same problem exists.
... View more