How to find .conf files on a splunk interface which is only accessible via a URL?

[hunterpj]

I need to locate the savedsearches.conf on a Splunk web server i.e. I can only reach this Splunk instance with a URL. if there is an app that allows this to happen that would be great too. I essentially want to copy/paste these alerts from the online instance to another instance, however I can only obtain the saved search properties via job inspection, which isn't in the format I want.

[MuS · Accepted solution]

Hi hunterpj,

you can always use REST calls if you have the privilege to use them:

 | REST splunk_server=local /servicesNS/-/-/saved/searches/

will give you a list of the saved searches that are not private.

There is also an App called Web Terminal https://splunkbase.splunk.com/app/1607/ which allows you to use btool from the Splunk UI and therefore use this command to list all saved searches from any savedsearches.conf

splunk cmd btool savedsearches list --debug

remember you need to exclude all default settings from this output.

Hope this helps ...

cheers, MuS

[hunterpj]

Is there any way to view the configurations file directly using the REST API? This helps, but isn't in the format of the savedsearches.conf as shown in the local savedsearches.conf file I have on my local instance. I am currently trying to use the REST API command configs/conf-{file}/{name}, but its not working for me.

[MuS]

Might be a permission issue.
If you can use the Web Terminal and run btool you would get a list that you can use to copy / paste.

cheers, MuS

[hunterpj]

Thank you for your help, this works.

[hunterpj]

As another note for anyone who comes along, I used in the Web Terminal the command:
btool savedsearches list --app=SPLUNK_APP

It works really well in isolating the alerts you want by app.