Getting Data In

Why are changes made to savedsearch not reflecting in Splunk Web or .conf files, but it displays as updated via API?

oclumbertruck
Explorer

Howdy folks,

I've got a saved search that has 4 emails specified in action.email.to. This is correct looking in the saved search edit portion of splunk web, and the advanced edit.

If I query for the saved search via the REST API, the addresses are correct. I have a script that grabs the value of action.email.to for the given saved search, and then append another email address, and posts to the appropriate url. This seems to work just fine. If I do a GET against the saved search, it displays 5 email addresses.

However in Splunk Web, the saved search only displays the 4 addresses, as well as only 4 addresses in the advanced edit under action.email.to. If I check the savedsearches.conf, it has the 4 addresses....I've tried _bump, debug/reset, and restarting splunk, API still displayed 5 addresses, but 4 everywhere else.

What gives?

0 Karma
1 Solution

oclumbertruck
Explorer

I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.

View solution in original post

0 Karma

oclumbertruck
Explorer

I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...