Getting Data In

Why are changes made to savedsearch not reflecting in Splunk Web or .conf files, but it displays as updated via API?

oclumbertruck
Explorer

Howdy folks,

I've got a saved search that has 4 emails specified in action.email.to. This is correct looking in the saved search edit portion of splunk web, and the advanced edit.

If I query for the saved search via the REST API, the addresses are correct. I have a script that grabs the value of action.email.to for the given saved search, and then append another email address, and posts to the appropriate url. This seems to work just fine. If I do a GET against the saved search, it displays 5 email addresses.

However in Splunk Web, the saved search only displays the 4 addresses, as well as only 4 addresses in the advanced edit under action.email.to. If I check the savedsearches.conf, it has the 4 addresses....I've tried _bump, debug/reset, and restarting splunk, API still displayed 5 addresses, but 4 everywhere else.

What gives?

0 Karma
1 Solution

oclumbertruck
Explorer

I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.

View solution in original post

0 Karma

oclumbertruck
Explorer

I see the error in my ways....Since I had no context of App, rather than updating the saved search under a particular app, the REST call was creating a new saved search under the "search" app....Logging in as admin to splunk web made this very clear....Context is everything I suppose.

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...