Splunk Search

How do I find the queries & searches an App makes in ES or Splunk Enterprise? Thank u in advance for any help.

SamHTexas
Builder

In order to administer ES better am trying to find the queries, searches an app makes in addition to what data models it uses. Thank u for your help in advance.

Labels (1)
Tags (1)
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Searches are at: $SPLUNK_HOME/etc/apps/your_app_name/default/savedsearches.conf
Datamodels are at: $SPLUNK_HOME/etc/apps/your_app_name/default/datamodels.conf

You may also find one or both in the local directory, depending on if either is changed/customized.

There are also REST endpoints you can query for more info on scheduled/saved searchs:

| rest /servicesNS/-/your_app_name/saved/searches

| rest /servicesNS/your_user_name/your_app_name/saved/searches

----
An upvote would be appreciated and Accept Solution if it helps!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...