saved searches

[Siddharthnegi]

can I find all the saved searches which are using index=* rather than giving specific name. And all the saved searches which are not using (index) in their search

[yuanliu]

Something like

| rest /services/saved/searches
| where match(search, "\bindex *= *(\* |\*$)")
  OR NOT match(search, "\bindex *=")
| fields title search

[bowesmana]

This will get you the saved searches

| rest "/servicesNS/-/-/saved/searches" splunk_server=local 

and it will return a field called 'search' - you can then look in that to see what search statements are being used. Note that if your search contains macros you will also have to expand the macros too and search those.