Edits history of script submission #23958 for ' List saved searches (splunk)'

• bunnative

  Ap­pro­ved version

  Edit in Windmill

  Embed

  //native
  
  /**
   * List saved searches
   * List one page of saved searches (reports and alerts) visible to the token. Owner and app default to "-" (all); each entry's acl.owner and acl.app are what Dispatch saved search needs. Page with count (default 30) and offset; next_offset is null on the last page.
   */
  export async function main(
    auth: RT.Splunk,
    owner: string | undefined,
    app: string | undefined,
    search: string | undefined,
    count: number | undefined,
    offset: number | undefined
  ) {
    const base = auth.base_url.replace(/\/+$/, "")
    const pageSize = count || 30
    const start = offset ?? 0
    const url = new URL(
      `${base}/servicesNS/${encodeURIComponent(owner || "-")}/${encodeURIComponent(app || "-")}/saved/searches`
    )
    url.searchParams.append("output_mode", "json")
    url.searchParams.append("count", String(pageSize))
    url.searchParams.append("offset", String(start))
    if (search) url.searchParams.append("search", search)
  
    const response = await fetch(url, {
      headers: {
        Authorization: `Bearer ${auth.token}`,
        Accept: "application/json",
      },
    })
  
    if (!response.ok) {
      throw new Error(`${response.status} ${await response.text()}`)
    }
  
    const data = (await response.json()) as {
      entry?: unknown[]
      paging?: { total?: number }
    }
    const returned = data.entry?.length ?? 0
    const total = data.paging?.total
    // Stop on an empty page (Splunk SDK paginator rule), or earlier when the
    // feed's paging.total says this page reached the end.
    const done =
      returned === 0 || (typeof total === "number" && start + returned >= total)
    return { ...data, next_offset: done ? null : start + returned }
  }
  

  Submitted by hugo989 3 hours ago