We have a business need to document all reporting deliverables and I'd prefer to automate as much of it as possible. I'm looking for options to pull information out of savedsearches.conf across all apps/all search heads. Need to be able to retrieve things like the search name, the search syntax, schedule, earliest/latest timeframes, and e-mail action details. In a perfect world, I could also cross reference it with the metadata about who created/owned the search and related permissions.
Is this something that I can do within Splunk using metadata or other self-reporting tools? Or do I need to set up a new inputs to monitor all splunk/etc/apps///saavedsearches.conf locations in order to grab this information? Or is there some other preferred option?
take this REST search as a start:
| rest /servicesNS/-/-/saved/searches
You will get heaps of information from this search.
Hope this helps ...
I was confused at first because it looked like this wasn't returning any results. But I stepped away and when I came back... poof! AWESOME DATA! So, I'd just caution anyone else who tries this... be patient 😄
This is great! However, it returns a ton of information. Is there any way to limit the scope of returned values? To perhaps certain attributes? or specific app context?
Sure there is, just try this for example
| rest /servicesNS/-/-/saved/searches | search title="DMC*" this will return 13 saved searches from the
Monitoring Console. The
title is the name of any saved search.