Dashboards & Visualizations

Why is my Splunk REST API Saved Searches Query not handling namespace parameter?

New Member

(I am currently using Splunk 6.3.3 if that matters.)

Looking at the JavaScript documentation andit appears that I should be able to filter saved searches based on owner, app, and sharing.

I have three saved searches defined in an application:

  • alt text

However, when I attempt to get only these searches in the JavaScript & REST API, I see a list of globally shared searches for a variety of different applications:

# Some Javascript...

const splunkConfig = {
  # username, password, etc. for the ohd user
const service = new splunkjs.Service(splunkConfig);
const savedSearches = service.savedSearches({owner: "ohd", app: "dev_ohd", sharing: "user"});
savedSearches.fetch(function (err, savedSearches) {
  for (let i = 0; i < savedSearches.list().length; i++) {
    let searchInstance = savedSearches.list()[i];

When run this, the above code prints out the following:

... # correct owner, wrong app, wrong sharing
{ owner: 'ohd', app: 'search', sharing: 'global' }

# correct owner, app, and sharing
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }
{ owner: 'ohd', app: 'dev_ohd', sharing: 'user' }

# wrong owner, app, and sharing
{ owner: 'kevwang', app: 'search', sharing: 'global' }
{ owner: 'ohd',
  app: 'splunk_management_console',
  sharing: 'global' }
Per-Panel Filtering - Activity By User Over Time
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Recent Activity
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }
Per-Panel Filtering - Top Users
{ owner: 'admin', app: 'SA-Utils', sharing: 'global' }

Is there something obvious that I am missing? Using the REST API through splunk_instance_ip:8089/servicesNS/ohd/dev_ohd/saved/searches the same problem exists.

0 Karma


This is the expected behavior. You're seeing searches that are shared globally, which means they effectively do not have an app context.

In your screen shot you have "this apps" selected as your filter, if you select "all" you'll see the other searches there as well.

I think you can use this pagination and filter option to get exactly what you're looking for though:



0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...