Getting Data In

Can I use a REST API command to identify saved searches using a summary index?

philip_wong
Communicator

Can use a REST API command to identify saved searches using a summary index?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi philip.wong,

sure, try this:

| rest /services/saved/searches | search action.summary_index="1" | table title action.summary_index action.summary_index._name

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi philip.wong,

sure, try this:

| rest /services/saved/searches | search action.summary_index="1" | table title action.summary_index action.summary_index._name

Hope this helps ...

cheers, MuS

philip_wong
Communicator

Thanks!

I don't know why | rest /services/saved/searches only returns few saved searches for me.

Finally, I use this to get what I want.

| rest /servicesNS/admin/-/saved/searches
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...