topic Re: Why are changes made to savedsearch not reflecting in Splunk Web or .conf files, but it displays as updated via API? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-are-changes-made-to-savedsearch-not-reflecting-in-Splunk-Web/m-p/299907#M56724 <P>I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.</P> Thu, 18 May 2017 13:41:35 GMT oclumbertruck 2017-05-18T13:41:35Z Why are changes made to savedsearch not reflecting in Splunk Web or .conf files, but it displays as updated via API? https://community.splunk.com/t5/Getting-Data-In/Why-are-changes-made-to-savedsearch-not-reflecting-in-Splunk-Web/m-p/299906#M56723 <P>Howdy folks,</P> <P>I've got a saved search that has 4 emails specified in action.email.to. This is correct looking in the saved search edit portion of splunk web, and the advanced edit.</P> <P>If I query for the saved search via the REST API, the addresses are correct. I have a script that grabs the value of action.email.to for the given saved search, and then append another email address, and posts to the appropriate url. This seems to work just fine. If I do a GET against the saved search, it displays 5 email addresses.</P> <P>However in Splunk Web, the saved search only displays the 4 addresses, as well as only 4 addresses in the advanced edit under action.email.to. If I check the savedsearches.conf, it has the 4 addresses....I've tried _bump, debug/reset, and restarting splunk, API still displayed 5 addresses, but 4 everywhere else.</P> <P>What gives?</P> Wed, 17 May 2017 20:27:21 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-changes-made-to-savedsearch-not-reflecting-in-Splunk-Web/m-p/299906#M56723 oclumbertruck 2017-05-17T20:27:21Z Re: Why are changes made to savedsearch not reflecting in Splunk Web or .conf files, but it displays as updated via API? https://community.splunk.com/t5/Getting-Data-In/Why-are-changes-made-to-savedsearch-not-reflecting-in-Splunk-Web/m-p/299907#M56724 <P>I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.</P> Thu, 18 May 2017 13:41:35 GMT https://community.splunk.com/t5/Getting-Data-In/Why-are-changes-made-to-savedsearch-not-reflecting-in-Splunk-Web/m-p/299907#M56724 oclumbertruck 2017-05-18T13:41:35Z