Splunk Search

Query to list all objects in an app?

Jewatson17
Path Finder

I am trying to run a query to find all objects in a particular app (i.e alerts, dashboards, props, etc) Urgent. Thanks

0 Karma

gjanders
SplunkTrust
SplunkTrust

A late answer but:

| rest "/servicesNS/-/<yourappname>/directory" splunk_server=local 
| search eai:acl.app="<yourappname>"
| table title, eai:type

Would be similar to using the "all objects" in the Splunk user interface for a particular app, the second search narrows down to objects created (not created + visible) within the app

woodcock
Esteemed Legend

There is no such thing. You have to query each KO-type via the REST API associated with it and then do some filtering. I finally have a very well executing "Knowledge Object Manifest" Dashboard that is dozens of panels tall. Why does it have so many panels? Because Splunk decided in v6.? that there is NEVER a reason to have a stats panel with more than 100 rows so they ignore any value higher than 100. This REALLY bugs me and has forced me to have 10 panels to cover 1000 eventtypes so that I can do a global search on one screen to check everything at once.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...