Splunk Search

Splunk rest API - List "All configurations"

vamsigurram
Path Finder

Hi, 

WHen i go into splunk console --> settings --> "All Configurations", i see 2000+ entries for seach and reporting app.

How do i pull all these rows using rest api?

I want to list all these knowledge objects per author (owner).

I tried something like this, but that did not give all the results.

| rest "/servicesNS/-/search/saved/searches"

 

0 Karma
1 Solution

vamsigurram
Path Finder

Looking at splunk docs, i found the below REST API, gives all the info that "All Configurations"  is giving us.

 

| rest /servicesNS/-/search/directory | search eai:acl.app="search"

 

The only question, i have is why does splunk give me "All configurations" for all the apps, when i clearly mentioned search app, as highlighted above?

Hence i had to limit my results to search app, by doing | search eai:acl.app="search"

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The "All Configurations" page contains far more than saved searches.  To get all of the same information via REST requires multiple calls.

| rest /servicesNS/-/-/search/saved/searches
| rest /servicesNS/-/-/configs/conf-transforms
| rest /servicesNS/-/-/configs/conf-macros
| rest /servicesNS/-/-/configs/conf-commands

This is not a complete list.  The REST manual should have what you need to complete the task.

---
If this reply helps you, Karma would be appreciated.

vamsigurram
Path Finder

Looking at splunk docs, i found the below REST API, gives all the info that "All Configurations"  is giving us.

 

| rest /servicesNS/-/search/directory | search eai:acl.app="search"

 

The only question, i have is why does splunk give me "All configurations" for all the apps, when i clearly mentioned search app, as highlighted above?

Hence i had to limit my results to search app, by doing | search eai:acl.app="search"

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...