Splunk Search

Splunk REST API: How to filter saved searches by author/name?

splunkuserCA1
Path Finder

Using the Splunk REST API, one can use GET against the "saved/searches" endpoint and get a list of all Saved Searches.

We can use filters on the key names in the dictionary element to reduce the number of entries returned. However, I want to filter based on the <author><name> element: is that possible with the REST API?

Ultimately, I'm trying to answer this question with the REST API: what are all the saved searches that are created by a specific user / what are all the saved searches in a specific user's namespace?

 

References:

1) Example XML output is given in the documentation for "saved/searches": https://docs.splunk.com/Documentation/Splunk/8.0.5/RESTREF/RESTsearch#saved.2Fsearches

 

 

0 Karma

splunkuserCA1
Path Finder

I found the answer, unfortunately not through any documentation. By using Chrome's DevTools, I captured the Query String Parameters as I conducted a search in the Web UI. I see the "search" parameter uses "eai:acl.owner=USERNAME" .

 

So the curl command would be something like: curl -s 'https://splunk.com:8089/../search/saved/searches?search=(eai:acl.owner="USERNAME")'

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...