Getting Data In

Can I use a REST API command to identify saved searches using a summary index?

philip_wong
Communicator

Can use a REST API command to identify saved searches using a summary index?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi philip.wong,

sure, try this:

| rest /services/saved/searches | search action.summary_index="1" | table title action.summary_index action.summary_index._name

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi philip.wong,

sure, try this:

| rest /services/saved/searches | search action.summary_index="1" | table title action.summary_index action.summary_index._name

Hope this helps ...

cheers, MuS

philip_wong
Communicator

Thanks!

I don't know why | rest /services/saved/searches only returns few saved searches for me.

Finally, I use this to get what I want.

| rest /servicesNS/admin/-/saved/searches
Get Updates on the Splunk Community!

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...

Insights from .conf 2025, Smart Edge Processor Scaling, and a New Splunk Lantern ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...