How can I export all items from Settings>Searches, Reports, and Alerts?


So basically, I'm looking to effectively export/retrieve all content from Settings>Searches, Reports, and Alerts. Basically looking to build a reference document to list my alerts/reports with the underlying search. Is there a simple way to pull these from a location in the OS file structure instead of manually recording them from the UI? Tedious task, I know!

0 Karma


Splunk stores knowledge objects in conf files. Saved search and alerts can be found in savedsearches.conf.

The location of the file depends on the permissions ie; if user hasn't shared the search then it will be under user's directory, if it's shared in app, it will be in etc/apps/appname default or local directory

or just run

splunk cmd btool --debug savedsearches list 

or use rest

| rest /servicesNS/-/-/saved/searches splunk_server=local
Happy Splunking!

Splunk Employee
Splunk Employee

remark, with a btool you will only find the public or shared saved searches
from the system $SPLUNK_HOME/etc/system/(local|default)/savedsearches.conf
and from the apps $SPLUNK_HOME/etc/apps/(appname)/(local|default)/savedsearches.conf

If you want to find the "private" saved searched, you have to go in each profile
from $SPLUNK_HOME/etc/users/(username)/(appname)/(local|default)/savedsearches.conf

Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...