Using Splunk REST to list "saved searches" only returns a limited set of results

dibblel — Tue, 22 Oct 2013 15:19:50 GMT

The Splunk API appears to be limiting the number of "saved searches" returned. I am running the query with our admin account so I do not believe it is a permissions issue. However, I did notice if I adjust a query to GLOBAL it appears to show up in the list.

Is there not a way to show ALL saved searches?

Example query:

curl -k -u admin:$PASS "splunk:8089/servicesNS/admin/search/saved/searches?count=100"

curl -k -u admin:$PASS "splunk:8089/services/saved/searches?count=100"

Thanks!

Re: Using Splunk REST to list "saved searches" only returns a limited set of results

dibblel — Tue, 22 Oct 2013 15:52:56 GMT

I found the answer to my question:

"splunk:8089/servicesNS/-/-/saved/searches?count=100"

I do not know why this is not included in the documentation as it clearly states, "List all saved searched on this Splunk instance" for the below command.

curl -k -u admin:pass "localhost:8089/services/saved/searches"

topic Using Splunk REST to list "saved searches" only returns a limited set of results in Reporting

Using Splunk REST to list "saved searches" only returns a limited set of results

Re: Using Splunk REST to list "saved searches" only returns a limited set of results