Getting Data In

Is it possible to manage all saved searches in a custom app?

ben_leung
Builder

https://localhost/8089/servicesNS/-/search/saved/searches

Is this possible, manage all saved searches displayed in a custom app, basically get the view https://localhost:8000/en-US/manager/launcher/saved/searches for non-admin users.

If yes, I would like to know how to get started on this type of project.

0 Karma

ben_leung
Builder

The goal I am trying to do is to allow a certain role to see the private searches of all users. I want this in a separate app or view so that it is visible to this role.

I am not going to allow read and write access to all the individual private searches since there are over hundreds, and some of our environments have thousands.

We need a capability that allows access to private knowledge objects(searches, dashboards, etc.) but not other manager pages. A limited admin_all_objects...

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ben_leung,

one way would be to create a saved search, which runs as admin user, queries all saved searches and writes its results into a summary index. Use the summary index to feed your app / dashboards.

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Well, in this case your original question is wrong: you asked how to view them and not how to manage them 😉

0 Karma

ben_leung
Builder

That would work for users to see the private searches of other users.

What I really want is the capability to clone the private searches.

I have a role that is non-admin that I want to be in charge of scheduling users private search by first cloning them and then scheduling them, making them a dedicated job user.

It would be simple to give them admin_all_objects to view the private searches, but I don't want to give them all the access to the other manager pages like access control.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...