Hello @daniedoe  /services/saved/searches Fetches saved searches globally across all apps the authenticated user has access to and results depend on the permissions of the user making the API call. If you need a broader scope across multiple apps or want results influenced by user permissions, use this namespace. /servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches Specifically queries saved searches within the SplunkEnterpriseSecuritySuite app and uses the nobody namespace, meaning searches owned by nobody (i.e., shared objects) in that app. If your application is specifically working within Splunk Enterprise Security and only needs correlation searches from ES, prefer this namespace. Hopefully this helps. Have a nice day,   ... View more