Getting Data In

How can I list all views owned by a particular user?

twinspop
Influencer

I've tried the /servicesNS/userid/-/data/ui/views endpoint but maybe I'm not using it correctly. I have a known view owned by the user that does not show anywhere in the output from calling that endpoint.

curl -sku admin:password https://127.0.0.1:8089/servicesNS/userid/his_app/data/ui/views | grep known_view_name

The view I searched for is in the app, is shared at app level. If I run:

curl -sku admin:password https://127.0.0.1:8089/servicesNS/userid/his_app/data/ui/views/known_view_name

I get results. What am I missing?

I want a list of the view names (not the titles) for a particular user.

Thanks!

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

How about a splunk search with "| rest" (Please replace $username$ with a proper user name)

| rest splunk_server=local /servicesNS/-/-/data/ui/views  
   | table eai:acl.sharing eai:acl.owner id 
   | rename eai:acl.owner as owner, eai:acl.sharing AS sharing  | search owner=$username$

View solution in original post

Masa
Splunk Employee
Splunk Employee

How about a splunk search with "| rest" (Please replace $username$ with a proper user name)

| rest splunk_server=local /servicesNS/-/-/data/ui/views  
   | table eai:acl.sharing eai:acl.owner id 
   | rename eai:acl.owner as owner, eai:acl.sharing AS sharing  | search owner=$username$

twinspop
Influencer

Yeah, that would work. Was hoping for a single script solution, but I can copy-pasta.

0 Karma

wrangler2x
Motivator

Add title immediately after table in the second line of the search to get the search name.

0 Karma

twinspop
Influencer

Actually, throwing this on the command line works really well. I can feed it into a for loop. The end result being a batch ownership change script.

0 Karma

twinspop
Influencer

Aha. The user had too many views to fit in the default count returned. Final product, including new '?count=0' specifier.

curl -sku admin:password 'https://127.0.0.1:8089/servicesNS/user/app/data/ui/views?count=0' | grep '<id>' | grep app/data/ui/views/ | sed -e 's^.*/views/^^' | sed -e 's^</id>^^'

EDIT: It's imperfect. I see views owned by "nobody" in the returned list. Still trying to find the magix to return just the views owned by user. -sigh-

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...