Getting Data In

Output saved searches by owner

ejread
Explorer

To reduce duplication of efforts and clean up resource-intensive searches, I am trying to output a list of all saved searches, including the following attributes -

  • Name of search
  • Owner
  • Is it scheduled?
  • Schedule time
  • Search string

I have used the Splunk btool command, which provided everything except for the search owner. Is there any way to obtain this info?

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

This should get you started :

| rest /servicesNS/-/-/saved/searches | fields title *owner* *search* *schedule*

Run from the search bar

View solution in original post

jonuwz
Influencer

This should get you started :

| rest /servicesNS/-/-/saved/searches | fields title *owner* *search* *schedule*

Run from the search bar

ejread
Explorer

This worked great. I had to add the count argument to see them all, but this is exactly what we needed. thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...