Reporting
Highlighted

Is there a way to report on the information located in savedsearches.conf?

Communicator

We have a business need to document all reporting deliverables and I'd prefer to automate as much of it as possible. I'm looking for options to pull information out of savedsearches.conf across all apps/all search heads. Need to be able to retrieve things like the search name, the search syntax, schedule, earliest/latest timeframes, and e-mail action details. In a perfect world, I could also cross reference it with the metadata about who created/owned the search and related permissions.

Is this something that I can do within Splunk using metadata or other self-reporting tools? Or do I need to set up a new inputs to monitor all splunk/etc/apps///saavedsearches.conf locations in order to grab this information? Or is there some other preferred option?

0 Karma
Highlighted

Re: Is there a way to report on the information located in savedsearches.conf?

SplunkTrust
SplunkTrust

Hi kearaspoor,

take this REST search as a start:

  | rest /servicesNS/-/-/saved/searches

You will get heaps of information from this search.

Hope this helps ...

cheers, MuS

View solution in original post

Highlighted

Re: Is there a way to report on the information located in savedsearches.conf?

Communicator

I was confused at first because it looked like this wasn't returning any results. But I stepped away and when I came back... poof! AWESOME DATA! So, I'd just caution anyone else who tries this... be patient 😄

Thank you!

0 Karma
Highlighted

Re: Is there a way to report on the information located in savedsearches.conf?

Path Finder

This is great! However, it returns a ton of information. Is there any way to limit the scope of returned values? To perhaps certain attributes? or specific app context?

0 Karma
Highlighted

Re: Is there a way to report on the information located in savedsearches.conf?

SplunkTrust
SplunkTrust

Sure there is, just try this for example | rest /servicesNS/-/-/saved/searches | search title="DMC*" this will return 13 saved searches from the Monitoring Console. The title is the name of any saved search.

cheers, MuS

0 Karma