Query to retrieve Saved Search String

[rmorlen]

I am trying to get an export of all of our saved searches so that we can review them. If I used the search "source=*scheduler.log* | eval search_time=strftime(scheduled_time,"%H:%M") | dedup savedsearch_name | table user search_time savedsearch_name" I get a nice table but what I would like to see is the actual search string tied to each saved search. We can then export the information so we can review the saved searches and try to optimize them.

(In case you are asking why we want to do this we have about 600 saved searches and about 21,000 scheduled searches running per day.)

Any suggestions on how I might get this information?

[rmorlen]

This works really well: "| rest /services/saved/searches | dedup search | table title search"

[rmorlen]

Ok. Thanks for the help. We have a dev/test instance of Splunk running 4.3.2 so I can just export all the users directories and bring them up in our dev instance and the search above should get us what we need.

Thank you.

[_d_]

| rest /services/saved/searches | table search

[Ayn · Accepted solution]

You can get this information through the wonderful rest command that was added in Splunk recently:

| rest /services/saved/searches

This will query the REST endpoint /services/saved/searches and present the output as search results.

[rmorlen]

Actually this doesn't seem to be doing what I need. It appears that it only returns results for "author noboby" and my username. Not saved searches for all users. ("| rest /services/saved/searches | sort title | table author title search")

[rmorlen]

Ah. We are running 4.2.5. The rest command doesn't work.