Splunk Search

How to write a search that shows all saved searches, reports & lookup tables that are shared globally?

HeinzWaescher
Motivator

Hi,

Is it possible to write a search that shows all saved searches, reports & lookup tables that are shared globally?

Thanks in advance

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

Run the below 2 searches -

1) Searches & Reports - | rest /servicesNS/-/-/saved/searches | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

2) Lookup table files - | rest /servicesNS/-/-/data/lookup-table-files | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

View solution in original post

dineshraj9
Builder

Run the below 2 searches -

1) Searches & Reports - | rest /servicesNS/-/-/saved/searches | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

2) Lookup table files - | rest /servicesNS/-/-/data/lookup-table-files | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

HeinzWaescher
Motivator

Awesome thanks, it there something similar for dashboards as well?

0 Karma

dineshraj9
Builder

Yes, the rest endpoint will let you access all configuration -

Views - | rest /servicesNS/-/-/data/ui/views/ | rename "eai:acl.owner" as owner,"eai:acl.sharing" as sharing,"eai:acl.app" as app | table title owner app sharing | where sharing="global"

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...