- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to write a search that shows all saved searche...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Is it possible to write a search that shows all saved searches, reports & lookup tables that are shared globally?
Thanks in advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run the below 2 searches -
1) Searches & Reports - | rest /servicesNS/-/-/saved/searches | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"
2) Lookup table files - | rest /servicesNS/-/-/data/lookup-table-files | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run the below 2 searches -
1) Searches & Reports - | rest /servicesNS/-/-/saved/searches | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"
2) Lookup table files - | rest /servicesNS/-/-/data/lookup-table-files | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome thanks, it there something similar for dashboards as well?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, the rest endpoint will let you access all configuration -
Views - | rest /servicesNS/-/-/data/ui/views/ | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
