Reporting

How do I list all the saved searches for an App in Splunk with rest?

drdosia
Explorer

I have tried this:
| rest /services/saved/searches | table title search
I got only 36 results.
I then tried
| rest /services/saved/searches | table ***
to see all the fields.

**eai:acl.app
matches what should show the Splunk App that the saved searches come from.
I got 36 results and eai:acl.app had "search" for all 36 of them. They match the saved searches in the search App.
I was running this as an id with the Admin role that should see all Apps.
I have over 100 Apps with anywhere from 3 to 70 saved searches each.
It does not matter that I am in any particular App (context). I get the same results only showing the 36 from the search App.
How do I list the saved searches from one (or more) of the other Apps?

This is on version 5.03

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll want the servicesNS REST endpoints, like this:

| rest /servicesNS/-/your_app/saved/searches

| rest /servicesNS/your_user/your_app/saved/searches

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You'll want the servicesNS REST endpoints, like this:

| rest /servicesNS/-/your_app/saved/searches

| rest /servicesNS/your_user/your_app/saved/searches

drdosia
Explorer

Follow-up
The answer by martin_Muller works, but be aware that you need to be logged in as a user that has access to Your_app
| rest /servicesNS/Your_user/Your_app/saved/searches | table eai:acl.app author title search

Note, unless you are an admin role you will not see the "private" non-shared saved searches

Many thanks to martin_mueller for a quick answer!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...