Splunk Search

How can I get a list of all saved searches from all apps using the REST command?

masonmorales
Influencer

So, I know I can get a list of saved searches by doing:

| rest /servicesNS/-/MYAPP/saved/searches | table title 

However, I want to list all saved searches from all Apps (which need to be dynamically discovered). How can I accomplish this?

1 Solution

harsmarvania57
Ultra Champion

Please use | rest /servicesNS/-/-/saved/searches splunk_server=local

Thanks,
Harshil

View solution in original post

harsmarvania57
Ultra Champion

Please use | rest /servicesNS/-/-/saved/searches splunk_server=local

Thanks,
Harshil

masonmorales
Influencer

This is what I needed. Thanks!

0 Karma

Runals
Motivator

I was going to suggest the same. I might suggest looking into the following app. It is a change management/tracker for several Splunk configuration files to include saved searches.

https://splunkbase.splunk.com/app/2627/

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...