<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic List all saved searches in Splunk Cloud in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/List-all-saved-searches-in-Splunk-Cloud/m-p/576388#M101849</link>
    <description>&lt;P&gt;Hi all,&lt;/P&gt;&lt;P&gt;I need to get a list of all the saved searches that are created in a Splunk Cloud environment. I tried to execute the regular rest command from the search view but the following message appears:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="pbalbasdtt_0-1637910829170.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/17018i156111A3AD686E8B/image-size/medium?v=v2&amp;amp;px=400" role="button" title="pbalbasdtt_0-1637910829170.png" alt="pbalbasdtt_0-1637910829170.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;I have been checking the capabilities available at the platform but the dispatch to indexers one doesn´t appear in the list (as it does in the on prem version).&lt;/P&gt;&lt;P&gt;Do you know which is the proper way on getting this info in Splunk Cloud? Many thanks in advance.&lt;/P&gt;&lt;P&gt;Best regards.&lt;/P&gt;</description>
    <pubDate>Fri, 26 Nov 2021 07:18:17 GMT</pubDate>
    <dc:creator>pbalbasdtt</dc:creator>
    <dc:date>2021-11-26T07:18:17Z</dc:date>
    <item>
      <title>List all saved searches in Splunk Cloud</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/List-all-saved-searches-in-Splunk-Cloud/m-p/576388#M101849</link>
      <description>&lt;P&gt;Hi all,&lt;/P&gt;&lt;P&gt;I need to get a list of all the saved searches that are created in a Splunk Cloud environment. I tried to execute the regular rest command from the search view but the following message appears:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="pbalbasdtt_0-1637910829170.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/17018i156111A3AD686E8B/image-size/medium?v=v2&amp;amp;px=400" role="button" title="pbalbasdtt_0-1637910829170.png" alt="pbalbasdtt_0-1637910829170.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;I have been checking the capabilities available at the platform but the dispatch to indexers one doesn´t appear in the list (as it does in the on prem version).&lt;/P&gt;&lt;P&gt;Do you know which is the proper way on getting this info in Splunk Cloud? Many thanks in advance.&lt;/P&gt;&lt;P&gt;Best regards.&lt;/P&gt;</description>
      <pubDate>Fri, 26 Nov 2021 07:18:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/List-all-saved-searches-in-Splunk-Cloud/m-p/576388#M101849</guid>
      <dc:creator>pbalbasdtt</dc:creator>
      <dc:date>2021-11-26T07:18:17Z</dc:date>
    </item>
    <item>
      <title>Re: List all saved searches in Splunk Cloud</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/List-all-saved-searches-in-Splunk-Cloud/m-p/576389#M101850</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;&lt;P&gt;as saved searches are in SH side, maybe this works for you?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| rest /servicesNS/-/-/saved/searches splunk_server=local
| where disabled == 0
| fields title description auto_summarize.command&lt;/LI-CODE&gt;&lt;P&gt;r. Ismo&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 26 Nov 2021 08:05:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/List-all-saved-searches-in-Splunk-Cloud/m-p/576389#M101850</guid>
      <dc:creator>isoutamo</dc:creator>
      <dc:date>2021-11-26T08:05:07Z</dc:date>
    </item>
  </channel>
</rss>

