List all saved searches in Splunk Cloud

[pbalbasdtt]

Hi all,

I need to get a list of all the saved searches that are created in a Splunk Cloud environment. I tried to execute the regular rest command from the search view but the following message appears:

pbalbasdtt_0-1637910829170.png

I have been checking the capabilities available at the platform but the dispatch to indexers one doesn´t appear in the list (as it does in the on prem version).

Do you know which is the proper way on getting this info in Splunk Cloud? Many thanks in advance.

Best regards.

[isoutamo · Accepted solution]

Hi

as saved searches are in SH side, maybe this works for you?

| rest /servicesNS/-/-/saved/searches splunk_server=local
| where disabled == 0
| fields title description auto_summarize.command

r. Ismo