Getting Data In

servicesns/user/app/saved/searches endpoint doesn't filter on user or app

Path Finder

Like the title says, I can hit the endpoint successfully, but the results are the same no matter what I replace "user" or "app" with. Does anyone know why I can't find just the saved searches within a user or app?

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Try something like this

| rest /servicesNS/-/-/saved/searches splunk_server=local | search eai:acl.owner="YourUserFilterHere" OR eai:acl.app="YourAppNameFilterHere"
0 Karma

Path Finder

Thanks for the reply! Do you know how I would go about doing that through the rest API?

0 Karma