Getting Data In

REST API: How do I limit saved searches to a specific app?

Path Finder

I'm trying to list names and ID all the saved searches in a given app by specifying the app in my HTTP request, like so:

curl -Lsk -H "Authorization: Bearer ${LONG_TOKEN}" -d "output_mode=json" -X GET "https://MyServer:8089/servicesNS/-/MyTeam/saved/searches?count=-1" | ~/jq '.entry[] | {name, value: .id}'

(I'm using JQ to filter out the fields I want)

But I can see clearly that this is returning results from all apps. Here's a snippet:

"name": "Top Container Memory Usage",
"value": "https://MyServer:8089/servicesNS/nobody/Splunk_TA_k8s/saved/searches/Top%20Container%20Memory%20Usag..."
"name": "TU_MyTeam_Tools_Alert",
"value": "https://MyServer:8089/servicesNS/nobody/MyTeam/saved/searches/TU_MyTeam_Tools_Alert"
"name": "Utils - Top REST actions",
"value": "https://MyServer:8089/servicesNS/nobody/SA-Utils/saved/searches/Utils%20-%20Top%20REST%20actions"

Given app "MyTeam," how do I request a list of saved searches from that app, and that app only?


Tags (2)
0 Karma


You put the search in an app that doesn't export the search globally.

See export in default.meta.conf.spec

Note the file is actually called default.meta or local.meta (no .conf) but the docs show .conf.spec

Also check out role based access control topics for controlling a role's access to the app.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...