Getting Data In

Why are changes made to savedsearch not reflecting in Splunk Web or .conf files, but it displays as updated via API?

oclumbertruck
Explorer

Howdy folks,

I've got a saved search that has 4 emails specified in action.email.to. This is correct looking in the saved search edit portion of splunk web, and the advanced edit.

If I query for the saved search via the REST API, the addresses are correct. I have a script that grabs the value of action.email.to for the given saved search, and then append another email address, and posts to the appropriate url. This seems to work just fine. If I do a GET against the saved search, it displays 5 email addresses.

However in Splunk Web, the saved search only displays the 4 addresses, as well as only 4 addresses in the advanced edit under action.email.to. If I check the savedsearches.conf, it has the 4 addresses....I've tried _bump, debug/reset, and restarting splunk, API still displayed 5 addresses, but 4 everywhere else.

What gives?

0 Karma
1 Solution

oclumbertruck
Explorer

I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.

View solution in original post

0 Karma

oclumbertruck
Explorer

I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...