Splunk Search

Splunk rest API - List "All configurations"

vamsigurram
Path Finder

Hi, 

WHen i go into splunk console --> settings --> "All Configurations", i see 2000+ entries for seach and reporting app.

How do i pull all these rows using rest api?

I want to list all these knowledge objects per author (owner).

I tried something like this, but that did not give all the results.

| rest "/servicesNS/-/search/saved/searches"

 

Labels (1)
0 Karma
1 Solution

vamsigurram
Path Finder

Looking at splunk docs, i found the below REST API, gives all the info that "All Configurations"  is giving us.

 

| rest /servicesNS/-/search/directory | search eai:acl.app="search"

 

The only question, i have is why does splunk give me "All configurations" for all the apps, when i clearly mentioned search app, as highlighted above?

Hence i had to limit my results to search app, by doing | search eai:acl.app="search"

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The "All Configurations" page contains far more than saved searches.  To get all of the same information via REST requires multiple calls.

| rest /servicesNS/-/-/search/saved/searches
| rest /servicesNS/-/-/configs/conf-transforms
| rest /servicesNS/-/-/configs/conf-macros
| rest /servicesNS/-/-/configs/conf-commands

This is not a complete list.  The REST manual should have what you need to complete the task.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vamsigurram
Path Finder

Looking at splunk docs, i found the below REST API, gives all the info that "All Configurations"  is giving us.

 

| rest /servicesNS/-/search/directory | search eai:acl.app="search"

 

The only question, i have is why does splunk give me "All configurations" for all the apps, when i clearly mentioned search app, as highlighted above?

Hence i had to limit my results to search app, by doing | search eai:acl.app="search"

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...