https://community.splunk.com/t5/Splunk-Search/saved-searches/m-p/690308#M235130 <P>Something like</P><LI-CODE lang="markup">| rest /services/saved/searches | where match(search, "\bindex *= *(\* |\*$)") OR NOT match(search, "\bindex *=") | fields title search</LI-CODE> Tue, 11 Jun 2024 07:16:26 GMT yuanliu 2024-06-11T07:16:26Z https://community.splunk.com/t5/Splunk-Search/saved-searches/m-p/690300#M235124 <P>can I find all the saved searches which are using index=* rather than giving specific name. And all the saved searches which are not using (index) in their search</P> Tue, 11 Jun 2024 06:50:27 GMT https://community.splunk.com/t5/Splunk-Search/saved-searches/m-p/690300#M235124 Siddharthnegi 2024-06-11T06:50:27Z https://community.splunk.com/t5/Splunk-Search/saved-searches/m-p/690307#M235129 <P>This will get you the saved searches</P><LI-CODE lang="markup">| rest "/servicesNS/-/-/saved/searches" splunk_server=local </LI-CODE><P>and it will return a field called 'search' - you can then look in that to see what search statements are being used. Note that if your search contains macros you will also have to expand the macros too and search those.</P><P>&nbsp;</P> Tue, 11 Jun 2024 07:16:12 GMT https://community.splunk.com/t5/Splunk-Search/saved-searches/m-p/690307#M235129 bowesmana 2024-06-11T07:16:12Z https://community.splunk.com/t5/Splunk-Search/saved-searches/m-p/690308#M235130 <P>Something like</P><LI-CODE lang="markup">| rest /services/saved/searches | where match(search, "\bindex *= *(\* |\*$)") OR NOT match(search, "\bindex *=") | fields title search</LI-CODE> Tue, 11 Jun 2024 07:16:26 GMT https://community.splunk.com/t5/Splunk-Search/saved-searches/m-p/690308#M235130 yuanliu 2024-06-11T07:16:26Z