REST API call to run a saved search with macro replacement?

Lowell — Fri, 06 Aug 2010 04:21:35 GMT

Is there a way to directly launch a saved search via the scheduler while passing key/value pairs for macro replacement via an API call?

The only place I've seen any reference to macro replacements for saved search is with the savedsearch search command documentation, and it's fairly brief. So I haven't seen anything that talks about how to do this, but that's not too surprising.

Just for the reccord, (because I'm sure someone will point it out)... Simply running a search of "| savedsearch mysavedsearch key=value" is not an option in my particular use case. I need any triggered actions associated with the saved search to be run, and the only way I know of doing that is via the scheduler. So I believe that rules out the possibility of using the savedsearch search command.

My ultimate goal is to do this from Splunk's python API. I can launch a saved search with the scheduler like so, the only piece I'm missing is how to pass in values for macro expansion. Any ideas?

import splunk.saved
job = splunk.saved.dispatchSavedSearch("mysavedsearch", sessionKey=sessionKey, namespace="myapp", owner="owner", triggerActions="1", now=timestamp)

Related stuff:

What is macro replacement in a saved search?

Re: REST API call to run a saved search with macro replacement?

Stephen_Sorkin — Sat, 21 Aug 2010 05:55:09 GMT

No, there is no facility for setting the saved search replacement parameters via the API.

topic Re: REST API call to run a saved search with macro replacement? in Splunk Dev

REST API call to run a saved search with macro replacement?

Re: REST API call to run a saved search with macro replacement?