<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: REST API: How do I limit saved searches to a specific app? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/REST-API-How-do-I-limit-saved-searches-to-a-specific-app/m-p/483161#M82769</link>
    <description>&lt;P&gt;You put the search in an app that doesn't export the search globally.&lt;/P&gt;

&lt;P&gt;See export in default.meta.conf.spec&lt;/P&gt;

&lt;P&gt;Note the file is actually called default.meta or local.meta (no .conf) but the docs show .conf.spec&lt;/P&gt;

&lt;P&gt;Also check out role based access control topics for controlling a role's access to the app.&lt;/P&gt;</description>
    <pubDate>Tue, 17 Sep 2019 17:08:19 GMT</pubDate>
    <dc:creator>jkat54</dc:creator>
    <dc:date>2019-09-17T17:08:19Z</dc:date>
    <item>
      <title>REST API: How do I limit saved searches to a specific app?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/REST-API-How-do-I-limit-saved-searches-to-a-specific-app/m-p/483160#M82768</link>
      <description>&lt;P&gt;I'm trying to list names and ID all the saved searches in a given app by specifying the app in my HTTP request, like so:&lt;/P&gt;

&lt;P&gt;curl -Lsk -H "Authorization: Bearer ${LONG_TOKEN}" -d "output_mode=json" -X GET  "&lt;A href="https://MyServer:8089/servicesNS/-/MyTeam/saved/searches?count=-1" target="_blank"&gt;https://MyServer:8089/servicesNS/-/MyTeam/saved/searches?count=-1&lt;/A&gt;" | ~/jq '.entry[] | {name, value: .id}'&lt;/P&gt;

&lt;P&gt;(I'm using JQ to filter out the fields I want)&lt;/P&gt;

&lt;P&gt;But I can see clearly that this is returning results from all apps. Here's a snippet:&lt;/P&gt;

&lt;P&gt;{&lt;BR /&gt;
  "name": "Top Container Memory Usage",&lt;BR /&gt;
  "value": "&lt;A href="https://MyServer:8089/servicesNS/nobody/Splunk_TA_k8s/saved/searches/Top%20Container%20Memory%20Usage" target="_blank"&gt;https://MyServer:8089/servicesNS/nobody/Splunk_TA_k8s/saved/searches/Top%20Container%20Memory%20Usage&lt;/A&gt;"&lt;BR /&gt;
}&lt;BR /&gt;
{&lt;BR /&gt;
  "name": "TU_MyTeam_Tools_Alert",&lt;BR /&gt;
  "value": "&lt;A href="https://MyServer:8089/servicesNS/nobody/MyTeam/saved/searches/TU_MyTeam_Tools_Alert" target="_blank"&gt;https://MyServer:8089/servicesNS/nobody/MyTeam/saved/searches/TU_MyTeam_Tools_Alert&lt;/A&gt;"&lt;BR /&gt;
}&lt;BR /&gt;
{&lt;BR /&gt;
  "name": "Utils - Top REST actions",&lt;BR /&gt;
  "value": "&lt;A href="https://MyServer:8089/servicesNS/nobody/SA-Utils/saved/searches/Utils%20-%20Top%20REST%20actions" target="_blank"&gt;https://MyServer:8089/servicesNS/nobody/SA-Utils/saved/searches/Utils%20-%20Top%20REST%20actions&lt;/A&gt;"&lt;BR /&gt;
}&lt;/P&gt;

&lt;P&gt;Given app "MyTeam," how do I request a list of saved searches from that app, and that app only?&lt;/P&gt;

&lt;P&gt;Thanks.&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 02:12:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/REST-API-How-do-I-limit-saved-searches-to-a-specific-app/m-p/483160#M82768</guid>
      <dc:creator>niall_munnelly</dc:creator>
      <dc:date>2020-09-30T02:12:57Z</dc:date>
    </item>
    <item>
      <title>Re: REST API: How do I limit saved searches to a specific app?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/REST-API-How-do-I-limit-saved-searches-to-a-specific-app/m-p/483161#M82769</link>
      <description>&lt;P&gt;You put the search in an app that doesn't export the search globally.&lt;/P&gt;

&lt;P&gt;See export in default.meta.conf.spec&lt;/P&gt;

&lt;P&gt;Note the file is actually called default.meta or local.meta (no .conf) but the docs show .conf.spec&lt;/P&gt;

&lt;P&gt;Also check out role based access control topics for controlling a role's access to the app.&lt;/P&gt;</description>
      <pubDate>Tue, 17 Sep 2019 17:08:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/REST-API-How-do-I-limit-saved-searches-to-a-specific-app/m-p/483161#M82769</guid>
      <dc:creator>jkat54</dc:creator>
      <dc:date>2019-09-17T17:08:19Z</dc:date>
    </item>
  </channel>
</rss>

