I am using a search command to find the savedsearches.conf for an alert. I created a search which can list all of the parameters in the savedsearches.conf, however it merges both the default and local savedsearches.conf for that alert. the search I use is below:
| rest splunk_server=local /servicesNS/-/-/configs/conf-savedsearches search="eai:acl.app=INSERT_APP_NAME"
| search title="INSERT_ALERT_TITLE"
| rename eai:acl.app as app, eai:acl.perms.read as read, eai:acl.sharing as sharing
| fields - updated published id eai*
| fields title author splunk_server app read sharing *
| eval title="[".title."]"
| foreach * [eval title=if("<>"="author" OR "<>"="splunk_server" OR "<>"="app" OR "<>"="read" OR "<>"="sharing" OR "<>"="title" OR '<>'="",title,mvappend(title,"<>"."="."\"".'<>'."\""))]
| fields title author splunk_server app read sharing
| search title=**
Is there any way for me to only see the local portion of the savedsearches.conf?
↧