I'm trying to list names and ID all the saved searches in a given app by specifying the app in my HTTP request, like so:
curl -Lsk -H "Authorization: Bearer ${LONG_TOKEN}" -d "output_mode=json" -X GET "https://MyServer:8089/servicesNS/-/MyTeam/saved/searches?count=-1" | ~/jq '.entry[] | {name, value: .id}'
(I'm using JQ to filter out the fields I want)
But I can see clearly that this is returning results from all apps. Here's a snippet:
{
"name": "Top Container Memory Usage",
"value": "https://MyServer:8089/servicesNS/nobody/Splunk_TA_k8s/saved/searches/Top%20Container%20Memory%20Usage"
}
{
"name": "TU_MyTeam_Tools_Alert",
"value": "https://MyServer:8089/servicesNS/nobody/MyTeam/saved/searches/TU_MyTeam_Tools_Alert"
}
{
"name": "Utils - Top REST actions",
"value": "https://MyServer:8089/servicesNS/nobody/SA-Utils/saved/searches/Utils%20-%20Top%20REST%20actions"
}
Given app "MyTeam," how do I request a list of saved searches from that app, and that app only?
Thanks.
↧