Splunk Search

Why can't I find savedsearches over REST with permissions set to "App" ?

fvo
Explorer

We want to run a couple analyses over all our savedsearches in a particular app. The permissions of these savedsearches are all set to "App". As a user with all necessary privileges I'm able to see and run the searches in this app.

Althought, if I run the following search command to see the details of my savedsearches I dont get any results:

| rest /services/saved/searches | search eai:acl.app=myApp

If I change the permissions of the savedsearch to "Global" it will show up.
Do I miss anything? Or is this as designed and rest search command only shows "Global" objects?

Due to security reasons I'm not able to keep the searches global so we need to find an other solution for that..

Thanks!

0 Karma
1 Solution

vganjare
Builder

Hi,

If you see the search job properties in job manager, by default, the above search looks for searches which are having sharing as global. Following is the sample:

{
    "app": "myapp", 
    "can_write": "1", 
    "modifiable": "1", 
    "owner": "admin", 
    "perms": {
        "read": [
            "admin"
        ], 
        "write": [
            "admin"
        ]
    }, 
    "sharing": "global", 
    "ttl": "600"
}

Try the answer provided for http://answers.splunk.com/answers/210410/how-do-i-list-all-the-saved-searches-for-an-app-in.html

Thanks!!

View solution in original post

vganjare
Builder

Hi,

If you see the search job properties in job manager, by default, the above search looks for searches which are having sharing as global. Following is the sample:

{
    "app": "myapp", 
    "can_write": "1", 
    "modifiable": "1", 
    "owner": "admin", 
    "perms": {
        "read": [
            "admin"
        ], 
        "write": [
            "admin"
        ]
    }, 
    "sharing": "global", 
    "ttl": "600"
}

Try the answer provided for http://answers.splunk.com/answers/210410/how-do-i-list-all-the-saved-searches-for-an-app-in.html

Thanks!!

fvo
Explorer

using servicesNS instead of services worked! thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...