Getting Data In

servicesns/user/app/saved/searches endpoint doesn't filter on user or app

joemaz95
Path Finder

Like the title says, I can hit the endpoint successfully, but the results are the same no matter what I replace "user" or "app" with. Does anyone know why I can't find just the saved searches within a user or app?

Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

| rest /servicesNS/-/-/saved/searches splunk_server=local | search eai:acl.owner="YourUserFilterHere" OR eai:acl.app="YourAppNameFilterHere"
0 Karma

joemaz95
Path Finder

Thanks for the reply! Do you know how I would go about doing that through the rest API?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!