Like the title says, I can hit the endpoint successfully, but the results are the same no matter what I replace "user" or "app" with. Does anyone know why I can't find just the saved searches within a user or app?
Try something like this
| rest /servicesNS/-/-/saved/searches splunk_server=local | search eai:acl.owner="YourUserFilterHere" OR eai:acl.app="YourAppNameFilterHere"
Thanks for the reply! Do you know how I would go about doing that through the rest API?
