Getting Data In

How do I write a Rest Query to fetch all unsaved searches along with userid ( optional )

splunkfriend123
Engager

Hi Team,

While exploring Splunk documentation and few scenarios ,

noticed that there is Rest approach to extract  saved one. 

But i would like to extract unsaved ( adhoc ) searches performed to understand patterns and load

1. Unsaved searches performed on given index or all indexes along with the query used. 

I found below threads which can be used to fetch saved searches 

https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-list-of-all-saved-searches-from-all-ap... 

https://community.splunk.com/t5/Splunk-Search/Listing-all-saved-searches-from-all-apps-via-REST-with...

Is there any Rest based query which can be used for extracting to find adhoc searches performed on splunk to understand load patterns.

 

 

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not aware of a REST command for that specific use case, but you can use REST to run a search for unsaved (ad-hoc) searches.  Start with this search

index=_audit source=audittrail sourcetype=audittrail action=search savedsearch_name=""

Finding searches against a specific index is challenging.  Index names may or may not be specified in the query text.

---
If this reply helps you, Karma would be appreciated.
0 Karma

splunkfriend123
Engager

Hi @richgalloway 

Thanks for your quickresponse.

Currently i am looking for Rest based query.

With below query i am able to find saved searches , not sure how to tweak below query to cater my need to fetch unsaved / adhoc searches performed. 

Query to fetch saved searches : 

| rest /servicesNS/-/-/saved/searches splunk_server=local 

https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-list-of-all-saved-searches-from-all-ap...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As I wrote earlier, there is no REST command to fetch ad-hoc searches.  You can, however, use REST to submit a new search job (using the query provided earlier) to extract ad-hoc search info from the logs.

---
If this reply helps you, Karma would be appreciated.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Can you just setup MC (monitoring console) and use it to see those searches? 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...