<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Is there any way to list all the saved searches in Splunk? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-list-all-the-saved-searches-in-Splunk/m-p/267334#M51188</link>
    <description>&lt;P&gt;Hi Praveenbandi&lt;/P&gt;

&lt;P&gt;Below rest command will help you to get all secheduled searches, to list all the searches run the second search&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1  | table title,  cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Search to get all saved searches. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest /servicesNS/-/-/saved/searches  | table title,   cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;to know all the users and their scheduled searches. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1   | stats values(eai:acl.app) as application c by title, eai:acl.owner | fields - c
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Wed, 01 Feb 2017 18:10:44 GMT</pubDate>
    <dc:creator>vasanthmss</dc:creator>
    <dc:date>2017-02-01T18:10:44Z</dc:date>
    <item>
      <title>Is there any way to list all the saved searches in Splunk?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-list-all-the-saved-searches-in-Splunk/m-p/267333#M51187</link>
      <description>&lt;P&gt;Hi Splunkers,&lt;/P&gt;

&lt;P&gt;Is there any way to list all the saved searches in Splunk? I want to export the saved searches details along with the user and scheduled time and etc. &lt;/P&gt;</description>
      <pubDate>Wed, 01 Feb 2017 18:06:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-list-all-the-saved-searches-in-Splunk/m-p/267333#M51187</guid>
      <dc:creator>praveenbandi</dc:creator>
      <dc:date>2017-02-01T18:06:11Z</dc:date>
    </item>
    <item>
      <title>Re: Is there any way to list all the saved searches in Splunk?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-list-all-the-saved-searches-in-Splunk/m-p/267334#M51188</link>
      <description>&lt;P&gt;Hi Praveenbandi&lt;/P&gt;

&lt;P&gt;Below rest command will help you to get all secheduled searches, to list all the searches run the second search&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1  | table title,  cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Search to get all saved searches. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest /servicesNS/-/-/saved/searches  | table title,   cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;to know all the users and their scheduled searches. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1   | stats values(eai:acl.app) as application c by title, eai:acl.owner | fields - c
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 01 Feb 2017 18:10:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-list-all-the-saved-searches-in-Splunk/m-p/267334#M51188</guid>
      <dc:creator>vasanthmss</dc:creator>
      <dc:date>2017-02-01T18:10:44Z</dc:date>
    </item>
    <item>
      <title>Re: Is there any way to list all the saved searches in Splunk?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-list-all-the-saved-searches-in-Splunk/m-p/267335#M51189</link>
      <description>&lt;P&gt;| rest /servicesNS/-/-/saved/searches splunk_server=local&lt;/P&gt;

&lt;P&gt;As per: &lt;A href="https://answers.splunk.com/answers/231694/how-can-i-get-a-list-of-all-saved-searches-from-al.html"&gt;https://answers.splunk.com/answers/231694/how-can-i-get-a-list-of-all-saved-searches-from-al.html&lt;/A&gt;&lt;BR /&gt;
Also: &lt;A href="https://answers.splunk.com/answers/12488/how-to-list-saved-searches.html"&gt;https://answers.splunk.com/answers/12488/how-to-list-saved-searches.html&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 01 Feb 2017 18:12:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Is-there-any-way-to-list-all-the-saved-searches-in-Splunk/m-p/267335#M51189</guid>
      <dc:creator>bohanlon_splunk</dc:creator>
      <dc:date>2017-02-01T18:12:44Z</dc:date>
    </item>
  </channel>
</rss>

