Getting Data In

Output saved searches by owner

ejread
Explorer

To reduce duplication of efforts and clean up resource-intensive searches, I am trying to output a list of all saved searches, including the following attributes -

  • Name of search
  • Owner
  • Is it scheduled?
  • Schedule time
  • Search string

I have used the Splunk btool command, which provided everything except for the search owner. Is there any way to obtain this info?

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

This should get you started :

| rest /servicesNS/-/-/saved/searches | fields title *owner* *search* *schedule*

Run from the search bar

View solution in original post

jonuwz
Influencer

This should get you started :

| rest /servicesNS/-/-/saved/searches | fields title *owner* *search* *schedule*

Run from the search bar

ejread
Explorer

This worked great. I had to add the count argument to see them all, but this is exactly what we needed. thanks!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...