<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: API access: app-specific searches and macros not available? in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/API-access-app-specific-searches-and-macros-not-available/m-p/94869#M2169</link>
    <description>&lt;P&gt;I now see the API can be used to connect to particular app contexts via ServicesNS -- i think. &lt;/P&gt;</description>
    <pubDate>Fri, 16 Mar 2012 16:36:27 GMT</pubDate>
    <dc:creator>twinspop</dc:creator>
    <dc:date>2012-03-16T16:36:27Z</dc:date>
    <item>
      <title>API access: app-specific searches and macros not available?</title>
      <link>https://community.splunk.com/t5/Reporting/API-access-app-specific-searches-and-macros-not-available/m-p/94868#M2168</link>
      <description>&lt;P&gt;I have a user and a role that both default to a particular app. That app has searches and macros defined that are only available in the app, but readable by everyone. When accessing the Web UI with the user in question I can run the saved searches and macros just fine. If I access the system via the API, I cannot access the saved searches or macros:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Error in 'savedsearch' command: Unable to find saved search named 'MON_somesearch'
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Are saved searches' and macros' app context unavailable in the API? Aside from making them globally visible, which would be very messy, any tips for a workaround?&lt;/P&gt;</description>
      <pubDate>Fri, 16 Mar 2012 16:24:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/API-access-app-specific-searches-and-macros-not-available/m-p/94868#M2168</guid>
      <dc:creator>twinspop</dc:creator>
      <dc:date>2012-03-16T16:24:01Z</dc:date>
    </item>
    <item>
      <title>Re: API access: app-specific searches and macros not available?</title>
      <link>https://community.splunk.com/t5/Reporting/API-access-app-specific-searches-and-macros-not-available/m-p/94869#M2169</link>
      <description>&lt;P&gt;I now see the API can be used to connect to particular app contexts via ServicesNS -- i think. &lt;/P&gt;</description>
      <pubDate>Fri, 16 Mar 2012 16:36:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/API-access-app-specific-searches-and-macros-not-available/m-p/94869#M2169</guid>
      <dc:creator>twinspop</dc:creator>
      <dc:date>2012-03-16T16:36:27Z</dc:date>
    </item>
    <item>
      <title>Re: API access: app-specific searches and macros not available?</title>
      <link>https://community.splunk.com/t5/Reporting/API-access-app-specific-searches-and-macros-not-available/m-p/94870#M2170</link>
      <description>&lt;P&gt;Did you work out what was going on here? I'm trying to shoot API commands (as the user with the macro defined) and it's acting like it doesn't exist at all: &lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;Error in 'SearchParser': Missing a search command before '|'. Error at position '36' of search query 'search index=extended |   | fields user '.&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;The space between the pipes should have the macro in it.&lt;/P&gt;

&lt;P&gt;EDIT: Gah, nevermind, I wasn't escaping the backticks from the macro properly.&lt;/P&gt;</description>
      <pubDate>Tue, 01 Dec 2015 14:49:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/API-access-app-specific-searches-and-macros-not-available/m-p/94870#M2170</guid>
      <dc:creator>csmallon</dc:creator>
      <dc:date>2015-12-01T14:49:58Z</dc:date>
    </item>
  </channel>
</rss>

