Splunk Search
Highlighted

How can I get a list of all saved searches from all apps using the REST command?

Influencer

So, I know I can get a list of saved searches by doing:

| rest /servicesNS/-/MYAPP/saved/searches | table title 

However, I want to list all saved searches from all Apps (which need to be dynamically discovered). How can I accomplish this?

Highlighted

Re: How can I get a list of all saved searches from all apps using the REST command?

SplunkTrust
SplunkTrust

Please use | rest /servicesNS/-/-/saved/searches splunk_server=local

Thanks,
Harshil

View solution in original post

Highlighted

Re: How can I get a list of all saved searches from all apps using the REST command?

Influencer

This is what I needed. Thanks!

0 Karma
Highlighted

Re: How can I get a list of all saved searches from all apps using the REST command?

Motivator

I was going to suggest the same. I might suggest looking into the following app. It is a change management/tracker for several Splunk configuration files to include saved searches.

https://splunkbase.splunk.com/app/2627/

0 Karma