How to get saved searches from ES SH?

[splunk_luis12]

Hi folks,

I'm trying to get all saved searches from my SHC and ES SH running the following SPL, but I'm unable to see the ones from my ES SH (the SPL is being run on the SHC).

| rest /servicesNS/-/-/saved/searches

When running the SPL appears the following message: Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability.

The I tried running the following SPL and the message disappeared, however, I'm not able to see the saved searches from my ES SH.:

| rest splunk_server=local /servicesNS/-/-/saved/searches

Any idea about this? Is this because of the missing capability? Am I restricted to make this search?

Thanks in advance.

[splunk_luis12]

@johnhuang I'm a bit of a novice at this. What can be an example of a query that I should execute from the SHC to see that data from the ES SH in that summary index?

[johnhuang · Accepted solution]

Setup a schedule job to save the data into a summary index. You can limit the fields being saved to your needs.

| rest splunk_server="local" "/servicesNS/-/-/saved/searches" 
| search NOT search="| noop"
| fields - type "*append *"
| eval _time=now(), event_type="saved_searches", search_head="ES_SH"
| foreach search qualifiedSearch [| eval "<<FIELD>>"=replace(<<FIELD>>,"\n", ";;;") | eval "<<FIELD>>"=replace(<<FIELD>>,"\"", "!!!")]
| table _time event_type search_head *
| collect index="<summary_indexname>" source="splunk_saved_searches_backup" sourcetype="stash"

To query the saved report:

index="<summary_indexname>" source="splunk_saved_searches_backup" sourcetype="stash"
| dedup id
| foreach search qualifiedSearch [| rex field="<<FIELD>>" mode=sed "s/;;;/\n/g" | eval "<<FIELD>>"=replace(<<FIELD>>,"!!!", "\"") | eval "<<FIELD>>"=replace(<<FIELD>>,"\\\\\\\\", "\\\\")]
| table _time event_type search_head *

[johnhuang]

You will have to run the search on your ES search head. There's no easy way to access rest services of another search head.

[splunk_luis12]

Hi @johnhuang What about if I create a summary index with that data on the ES SH and I try to search it from the SHC? is that possible?

[johnhuang]

@splunk_luis12 yes that will work. A benefit of storing a copy of your saved searches in summary index is you now have a backup.