- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In a production application what factors should I consider deciding between using /services/saved/searches vs /servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches for a REST HTTP endpoint call to get correlation search information. Both return the same results for me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @daniedoe
/services/saved/searches
Fetches saved searches globally across all apps the authenticated user has access to and results depend on the permissions of the user making the API call. If you need a broader scope across multiple apps or want results influenced by user permissions, use this namespace.
/servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches
Specifically queries saved searches within the SplunkEnterpriseSecuritySuite app and uses the nobody namespace, meaning searches owned by nobody (i.e., shared objects) in that app. If your application is specifically working within Splunk Enterprise Security and only needs correlation searches from ES, prefer this namespace.
Hopefully this helps.
Have a nice day,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @daniedoe
/services/saved/searches
Fetches saved searches globally across all apps the authenticated user has access to and results depend on the permissions of the user making the API call. If you need a broader scope across multiple apps or want results influenced by user permissions, use this namespace.
/servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches
Specifically queries saved searches within the SplunkEnterpriseSecuritySuite app and uses the nobody namespace, meaning searches owned by nobody (i.e., shared objects) in that app. If your application is specifically working within Splunk Enterprise Security and only needs correlation searches from ES, prefer this namespace.
Hopefully this helps.
Have a nice day,
