Feature Request: Filter Saved Searches by Splunk App

Open
  • Is something wrong?
#208 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
68/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
python, vscode
Domain
api, devtools, documentation, testing

Research direction

Start at the Saved Searches explorer and its saved-search request path, then locate the extension's existing user/workspace settings and README configuration descriptions. Add coverage for configured and unset app filters, including URL encoding, and verify that refreshing uses the current setting while preserving the existing request when unset.

Written by the indexing model from the issue text.

Description

Summary

Add a configuration option to the Splunk VS Code extension that limits the Saved Searches explorer to a specific Splunk app.

Use Case

Splunk users often work with several apps and may have access to a large number of saved searches. The extension currently displays saved searches across the available scope, which makes it difficult to find searches belonging to the app used by the current project.

For example, a project may use:

SPLUNK_APP=splunk_test

The Saved Searches view should be able to display only searches from splunk_test.

Proposed Configuration

Add a setting such as:

{
    "splunk.commands.savedSearchesApp": "splunk_test"
}

An empty value should preserve the current behavior and return saved searches without an app filter.

The setting could alternatively be named splunk.savedSearches.app if that better matches the extension's configuration naming conventions.

Proposed API Behavior

When the setting is configured, include the Splunk app in the saved-search request:

/services/saved/searches?output_mode=json&app=splunk_test

When the setting is empty or unset, retain the existing request behavior.

The value should be URL-encoded before being added to the request.

Acceptance Criteria

  • Add a user/workspace setting for the saved-search app.
  • Display only saved searches available in the configured app.
  • Preserve the current behavior when no app is configured.
  • Support workspace-level configuration so different projects can use different Splunk apps.
  • URL-encode the configured app name.
  • Refreshing Saved Searches uses the current setting without requiring users to edit extension files.
  • Document the new setting in the extension README and configuration descriptions.
  • Add automated coverage for both configured and unset app filters.

Alternatives Considered

  • Manually filtering the Saved Searches view, which does not scale when many searches are available.
  • Forking or patching the extension bundle, which would be overwritten by extension updates.
  • Filtering searches after retrieval, which is less efficient and may not correctly represent Splunk permissions or app ownership.

Environment

  • VS Code
  • Splunk VS Code extension 0.4.0
  • Splunk Enterprise REST API on port 8089
Dominant language
Python
Stars
97
Forks
27
Avg merge
3d 24m
Merged PRs (30d)
2

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/vscode-extension-splunk

All issues in splunk/vscode-extension-splunk

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.