Getting Data In

Is there any way to list all the saved searches in Splunk?

praveenbandi
Explorer

Hi Splunkers,

Is there any way to list all the saved searches in Splunk? I want to export the saved searches details along with the user and scheduled time and etc.

1 Solution

vasanthmss
Motivator

Hi Praveenbandi

Below rest command will help you to get all secheduled searches, to list all the searches run the second search

| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1  | table title,  cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *

Search to get all saved searches.

| rest /servicesNS/-/-/saved/searches  | table title,   cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *

to know all the users and their scheduled searches.

| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1   | stats values(eai:acl.app) as application c by title, eai:acl.owner | fields - c
V

View solution in original post

vasanthmss
Motivator

Hi Praveenbandi

Below rest command will help you to get all secheduled searches, to list all the searches run the second search

| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1  | table title,  cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *

Search to get all saved searches.

| rest /servicesNS/-/-/saved/searches  | table title,   cron_schedule next_scheduled_time eai:acl.owner  actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *

to know all the users and their scheduled searches.

| rest /servicesNS/-/-/saved/searches  | search is_scheduled=1   | stats values(eai:acl.app) as application c by title, eai:acl.owner | fields - c
V
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...