Reporting

Is there a way to report on the information located in savedsearches.conf?

kearaspoor
Communicator

We have a business need to document all reporting deliverables and I'd prefer to automate as much of it as possible. I'm looking for options to pull information out of savedsearches.conf across all apps/all search heads. Need to be able to retrieve things like the search name, the search syntax, schedule, earliest/latest timeframes, and e-mail action details. In a perfect world, I could also cross reference it with the metadata about who created/owned the search and related permissions.

Is this something that I can do within Splunk using metadata or other self-reporting tools? Or do I need to set up a new inputs to monitor all splunk/etc/apps///saavedsearches.conf locations in order to grab this information? Or is there some other preferred option?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi kearaspoor,

take this REST search as a start:

  | rest /servicesNS/-/-/saved/searches

You will get heaps of information from this search.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi kearaspoor,

take this REST search as a start:

  | rest /servicesNS/-/-/saved/searches

You will get heaps of information from this search.

Hope this helps ...

cheers, MuS

View solution in original post

kearaspoor
Communicator

I was confused at first because it looked like this wasn't returning any results. But I stepped away and when I came back... poof! AWESOME DATA! So, I'd just caution anyone else who tries this... be patient 😄

Thank you!

0 Karma

pretzel2
Path Finder

This is great! However, it returns a ton of information. Is there any way to limit the scope of returned values? To perhaps certain attributes? or specific app context?

0 Karma

MuS
SplunkTrust
SplunkTrust

Sure there is, just try this for example | rest /servicesNS/-/-/saved/searches | search title="DMC*" this will return 13 saved searches from the Monitoring Console. The title is the name of any saved search.

cheers, MuS

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!