topic Option to return only app specific configurations in Splunk Dev

Option to return only app specific configurations

hrawat — Tue, 05 May 2026 04:39:50 GMT

With following you get 400+ fields( mostly unrelated to your app are from system/default)
Example

| rest splunk_server=local "/servicesNS/nobody/SA-Utils/configs/conf-savedsearches/Audit%20-%20Sourcetype%20readiness%20-%20Lookup%20gen" | fields *

With New appcontext , you can fetch app only configs.
Example

| rest splunk_server=local "/servicesNS/nobody/SA-Utils/configs/conf-savedsearches/Audit%20-%20Sourcetype%20readiness%20-%20Lookup%20gen?appcontext=true" | fields *

Re: Option to return only app specific configurations

gcusello — Tue, 05 May 2026 06:39:55 GMT

Hi @hrawat ,

could you better describe your search and its purpose?

because I have an error in my on-premise installation,

Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-Utils/configs/conf-savedsearches/Audit%20-%20Sourcetype%20readiness%20-%20Lookup%20gen?appcontext=true&count=0 from server=https://127.0.0.1:8089 - Not Found

and on Splunk Cloud I have a result but not so comprehensible.

Ciao.

Giuseppe

Re: Option to return only app specific configurations

bowesmana — Tue, 05 May 2026 06:51:57 GMT

That saved search

Audit - Sourcetype readiness - Lookup gen

is part of Enterprise Security app (SA-Utils) so unless you have it, you'll get the Not Found as you have

If you run that on one of your saved searched and add

| transpose 0

with and without appContext=true

You will see the count of fields returned. If I run that in a ES site, I get 248 fields without appContext and 32 with appContext=true

Re: Option to return only app specific configurations

livehybrid — Tue, 05 May 2026 07:35:43 GMT

What version of Splunk is this from please?

Re: Option to return only app specific configurations

hrawat — Tue, 05 May 2026 10:55:43 GMT

It's 9.1.9/9.2.6/9.3.4/9.4.2 and above

Re: Option to return only app specific configurations

hrawat — Tue, 05 May 2026 14:56:23 GMT

If you are calling configs/conf-<conf-file> rest endpoint from python script and are only interested in what any specific app conf looks like ( similar to btool --app option), then appcontext can be useful to reduce system/default/savedsearches.conf noise.
I used ES 8.x search as an example from SA-Utils app. If you are on 7.x, then the search name is ( R and G uppercase)

Audit%20-%20Sourcetype%20Readiness%20-%20Lookup%20Gen

For example, instead of running following btool command you can use above in the UI.

splunk btool --app=SA-Utils savedsearches list | grep "Audit - Sourcetype readiness - Lookup gen"