Splunk Search

How to write a search that shows all saved searches, reports & lookup tables that are shared globally?

HeinzWaescher
Motivator

Hi,

Is it possible to write a search that shows all saved searches, reports & lookup tables that are shared globally?

Thanks in advance

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

Run the below 2 searches -

1) Searches & Reports - | rest /servicesNS/-/-/saved/searches | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

2) Lookup table files - | rest /servicesNS/-/-/data/lookup-table-files | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

View solution in original post

dineshraj9
Builder

Run the below 2 searches -

1) Searches & Reports - | rest /servicesNS/-/-/saved/searches | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

2) Lookup table files - | rest /servicesNS/-/-/data/lookup-table-files | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

HeinzWaescher
Motivator

Awesome thanks, it there something similar for dashboards as well?

0 Karma

dineshraj9
Builder

Yes, the rest endpoint will let you access all configuration -

Views - | rest /servicesNS/-/-/data/ui/views/ | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...