The Splunk API appears to be limiting the number of "saved searches" returned. I am running the query with our admin account so I do not believe it is a permissions issue. However, I did notice if I adjust a query to GLOBAL it appears to show up in the list.
Is there not a way to show ALL saved searches?
Example query:
curl -k -u admin:$PASS "splunk:8089/servicesNS/admin/search/saved/searches?count=100"
curl -k -u admin:$PASS "splunk:8089/services/saved/searches?count=100"
Thanks!
... View more