topic Re: saved searches in Getting Data In

saved searches

Siddharthnegi — Mon, 17 Jun 2024 05:40:41 GMT

i want to get list of scheduled saved searches with the name and the searches itself. can anybody help?

Re: saved searches

bowesmana — Mon, 17 Jun 2024 06:29:39 GMT

Start here

| rest "/servicesNS/-/-/saved/searches" splunk_server=local search="is_scheduled=1" | rename eai:* as * acl.app as app | fields title app author type search

that will give you the data, then do what you need to do with it

Re: saved searches

jayanta2022 — Mon, 17 Jun 2024 08:00:14 GMT

| rest /servicesNS/-/-/saved/searches splunk_server=local

Getting all of your stored searches from the Search Head will be much easier with this.