/services/saved/searches vs /servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches

[daniedoe]

In a production application what factors should I consider deciding between using /services/saved/searches vs /servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches for a REST HTTP endpoint call to get correlation search information. Both return the same results for me.

[Cievo · Accepted solution]

Hello @daniedoe 

/services/saved/searches

Fetches saved searches globally across all apps the authenticated user has access to and results depend on the permissions of the user making the API call. If you need a broader scope across multiple apps or want results influenced by user permissions, use this namespace.

/servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches

Specifically queries saved searches within the SplunkEnterpriseSecuritySuite app and uses the nobody namespace, meaning searches owned by nobody (i.e., shared objects) in that app. If your application is specifically working within Splunk Enterprise Security and only needs correlation searches from ES, prefer this namespace.

Hopefully this helps.

Have a nice day,