Reporting

Query to retrieve Saved Search String

rmorlen
Splunk Employee
Splunk Employee

I am trying to get an export of all of our saved searches so that we can review them. If I used the search "source=*scheduler.log* | eval search_time=strftime(scheduled_time,"%H:%M") | dedup savedsearch_name | table user search_time savedsearch_name" I get a nice table but what I would like to see is the actual search string tied to each saved search. We can then export the information so we can review the saved searches and try to optimize them.

(In case you are asking why we want to do this we have about 600 saved searches and about 21,000 scheduled searches running per day.)

Any suggestions on how I might get this information?

1 Solution

Ayn
Legend

You can get this information through the wonderful rest command that was added in Splunk recently:

| rest /services/saved/searches

This will query the REST endpoint /services/saved/searches and present the output as search results.

View solution in original post

rmorlen
Splunk Employee
Splunk Employee

This works really well: "| rest /services/saved/searches | dedup search | table title search"

rmorlen
Splunk Employee
Splunk Employee

Ok. Thanks for the help. We have a dev/test instance of Splunk running 4.3.2 so I can just export all the users directories and bring them up in our dev instance and the search above should get us what we need.

Thank you.

0 Karma

_d_
Splunk Employee
Splunk Employee

| rest /services/saved/searches | table search

0 Karma

Ayn
Legend

You can get this information through the wonderful rest command that was added in Splunk recently:

| rest /services/saved/searches

This will query the REST endpoint /services/saved/searches and present the output as search results.

rmorlen
Splunk Employee
Splunk Employee

Actually this doesn't seem to be doing what I need. It appears that it only returns results for "author noboby" and my username. Not saved searches for all users. ("| rest /services/saved/searches | sort title | table author title search")

0 Karma

rmorlen
Splunk Employee
Splunk Employee

Ah. We are running 4.2.5. The rest command doesn't work.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...