topic Re: How to write a search that shows all saved searches, reports & lookup tables that are shared globally? in Splunk Search

How to write a search that shows all saved searches, reports & lookup tables that are shared globally?

HeinzWaescher — Mon, 24 Apr 2017 07:27:02 GMT

Hi,

Is it possible to write a search that shows all saved searches, reports & lookup tables that are shared globally?

Thanks in advance

Re: How to write a search that shows all saved searches, reports & lookup tables that are shared globally?

dineshraj9 — Mon, 24 Apr 2017 07:34:46 GMT

Run the below 2 searches -

1) Searches & Reports - | rest /servicesNS/-/-/saved/searches | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

2) Lookup table files - | rest /servicesNS/-/-/data/lookup-table-files | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

Re: How to write a search that shows all saved searches, reports & lookup tables that are shared globally?

HeinzWaescher — Mon, 24 Apr 2017 07:48:45 GMT

Awesome thanks, it there something similar for dashboards as well?

Re: How to write a search that shows all saved searches, reports & lookup tables that are shared globally?

dineshraj9 — Mon, 24 Apr 2017 08:21:29 GMT

Yes, the rest endpoint will let you access all configuration -

Views - | rest /servicesNS/-/-/data/ui/views/ | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"