https://community.splunk.com/t5/Splunk-Enterprise/services-saved-searches-vs-servicesNS-nobody/m-p/712149#M21691 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/276684">@daniedoe</a>&nbsp;</P><P><STRONG>/services/saved/searches</STRONG></P><P>Fetches saved searches globally across all apps the authenticated user has access to and results depend on the permissions of the user making the API call. If you need a broader scope across multiple apps or want results influenced by user permissions, use this namespace.</P><P><STRONG>/servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches</STRONG></P><P>Specifically queries saved searches within the SplunkEnterpriseSecuritySuite app and uses the nobody namespace, meaning searches owned by nobody (i.e., shared objects) in that app. If your application is specifically working within Splunk Enterprise Security and only needs correlation searches from ES, prefer this namespace.</P><P>Hopefully this helps.</P><P>Have a nice day,</P><P>&nbsp;</P> Thu, 20 Feb 2025 19:24:45 GMT Cievo 2025-02-20T19:24:45Z https://community.splunk.com/t5/Splunk-Enterprise/services-saved-searches-vs-servicesNS-nobody/m-p/712147#M21690 <P>In a production application what factors should I consider deciding between using&nbsp;/services/saved/searches vs /servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches for a REST HTTP endpoint call to get correlation search information. Both return the same results for me.</P> Thu, 20 Feb 2025 19:07:33 GMT https://community.splunk.com/t5/Splunk-Enterprise/services-saved-searches-vs-servicesNS-nobody/m-p/712147#M21690 daniedoe 2025-02-20T19:07:33Z https://community.splunk.com/t5/Splunk-Enterprise/services-saved-searches-vs-servicesNS-nobody/m-p/712149#M21691 <P>Hello&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/276684">@daniedoe</a>&nbsp;</P><P><STRONG>/services/saved/searches</STRONG></P><P>Fetches saved searches globally across all apps the authenticated user has access to and results depend on the permissions of the user making the API call. If you need a broader scope across multiple apps or want results influenced by user permissions, use this namespace.</P><P><STRONG>/servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches</STRONG></P><P>Specifically queries saved searches within the SplunkEnterpriseSecuritySuite app and uses the nobody namespace, meaning searches owned by nobody (i.e., shared objects) in that app. If your application is specifically working within Splunk Enterprise Security and only needs correlation searches from ES, prefer this namespace.</P><P>Hopefully this helps.</P><P>Have a nice day,</P><P>&nbsp;</P> Thu, 20 Feb 2025 19:24:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/services-saved-searches-vs-servicesNS-nobody/m-p/712149#M21691 Cievo 2025-02-20T19:24:45Z