Option to return only app specific configurations

[hrawat]

With following you get 400+ fields( mostly unrelated to your app are from system/default)
Example

| rest splunk_server=local "/servicesNS/nobody/SA-Utils/configs/conf-savedsearches/Audit%20-%20Sourcetype%20readiness%20-%20Lookup%20gen"
| fields *

With New appcontext , you can fetch app only configs.
Example

| rest splunk_server=local "/servicesNS/nobody/SA-Utils/configs/conf-savedsearches/Audit%20-%20Sourcetype%20readiness%20-%20Lookup%20gen?appcontext=true"
| fields *

[livehybrid]

What version of Splunk is this from please?

[hrawat]

It's 9.1.9/9.2.6/9.3.4/9.4.2 and above

[gcusello]

Hi @hrawat ,

could you better describe your search and its purpose?

because I have an error in my on-premise installation,

Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-Utils/configs/conf-savedsearches/Audit%20-%20Sourcetype%20readiness%20-%20Lookup%20gen?appcontext=true&count=0 from server=https://127.0.0.1:8089 - Not Found

and on Splunk Cloud I have a result but not so comprehensible.

Ciao.

Giuseppe

[hrawat]

If you are calling configs/conf-<conf-file> rest endpoint from python script and are only interested in what any specific app conf looks like ( similar to btool --app option), then appcontext can be useful to reduce system/default/savedsearches.conf noise.  
I used ES 8.x search as an example from SA-Utils app. If you are on 7.x, then the search name is ( R and G uppercase)

Audit%20-%20Sourcetype%20Readiness%20-%20Lookup%20Gen

For example, instead of running following btool command you can use above in the UI.

splunk btool --app=SA-Utils savedsearches list | grep "Audit - Sourcetype readiness - Lookup gen"

[bowesmana]

That saved search

Audit - Sourcetype readiness - Lookup gen

is part of Enterprise Security app (SA-Utils) so unless you have it, you'll get the Not Found as you have

If you run that on one of your saved searched and add

| transpose 0

with and without appContext=true

You will see the count of fields returned. If I run that in a ES site, I get 248 fields without appContext and 32 with appContext=true