Splunk Dev

How to Get Saved Searches by Owner Through REST API?

koocies
Path Finder

I see the EAI:ACL documentation mentions that an owner flag can be set. can this be used for getting saved searches based on the owner?
so far with curl I have not gotten the results as excepted (the owner is ignored)

If someone knows can you please give me an example?

here is my curl:

curl-k -u john:Password http://localhost:8089/servicesNS/-/app/saved/searches&eai:acl.owner=john

Labels (1)
0 Karma
1 Solution

koocies
Path Finder

Solution is to use the search parameter in the HTTP request:

curl-k -u john:Password http://localhost:8089/servicesNS/-/app/saved/searches?search=eai:acl.owner%3Djohn

 

I honestly don't understand why the username endpoint is used. a '-' for any then using search parameter to narrow down to the owner of saved searches works. 

View solution in original post

0 Karma

koocies
Path Finder

Solution is to use the search parameter in the HTTP request:

curl-k -u john:Password http://localhost:8089/servicesNS/-/app/saved/searches?search=eai:acl.owner%3Djohn

 

I honestly don't understand why the username endpoint is used. a '-' for any then using search parameter to narrow down to the owner of saved searches works. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try

curl-k -u john:Password http://localhost:8089/servicesNS/john/app/saved/searches
---
If this reply helps you, Karma would be appreciated.
0 Karma

koocies
Path Finder

this returns saved search owned by nobody and the user. It does not seem to filter to the user alone

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...