topic Re: Listing all saved searches from all apps via REST without correlation searches in Splunk Search

Listing all saved searches from all apps via REST without correlation searches

karadikid — Sun, 12 Jul 2020 14:39:05 GMT

Hi All,

So, I know I can get a list of all enabled saved searches by doing:

| rest count=0 /servicesNS/-/-/saved/searches | search disabled=0 | table title

However, I want to list all enabled saved searches from all Apps, which are NOT "correlation searches". Any idea how to implement such query?

Re: Listing all saved searches from all apps via REST without correlation searches

richgalloway — Mon, 13 Jul 2020 13:33:06 GMT

A correlation search is the same as a saved search. The only distinction is the app context. You can use the regex command to filter on eai:acl.app, but you'll have to come up with a regular expression that matches only ES apps. Something like this (which filters too much)

Re: Listing all saved searches from all apps via REST without correlation searches

karadikid — Tue, 14 Jul 2020 09:05:04 GMT

Thanks richgalloway!

So, can I safely assume that a correlation search is only related to SplunkES and simply negate other apps in my queries?

I also wonder how the UI returns specifically "Correlation Searches"\"Saved Searches"\etc... when searching via the "content management" UI. Any idea how I can mimic this behaviour?

Re: Listing all saved searches from all apps via REST without correlation searches

richgalloway — Tue, 14 Jul 2020 12:50:30 GMT

I dug further into my notes and found this query.

| rest splunk_server=local count=0 /services/saved/searches | where NOT 'action.correlationsearch.enabled'=1