topic Re: How to enable/disable a saved search using Python SDK? in Splunk Dev

How to enable/disable a saved search using Python SDK?

bollam — Fri, 05 Jan 2018 08:21:25 GMT

Can someone assist me in how to enable and disable the saved searches using python SDK?
I have gone through the docs of python SDK and got how to create and delete but where in I was looking for enabling and disabling the saved searches. Prompt response would be highly appreciated.

Re: How to enable/disable a saved search using Python SDK?

harsmarvania57 — Fri, 05 Jan 2018 12:49:18 GMT

Hi @bollam,

Can you please try below python code for disabling saved search

import splunk.rest as rest
rest.simpleRequest('/servicesNS/<USER>/<APPNAME>/saved/searches/<YOURSEARCH>', sessionKey=sessionKey, postargs={'disabled': 1}, method='POST', raiseAllErrors=True)

And to enable it again

import splunk.rest as rest
rest.simpleRequest('/servicesNS/<USER>/<APPNAME>/saved/searches/<YOURSEARCH>', sessionKey=sessionKey, postargs={'disabled': 0}, method='POST', raiseAllErrors=True)

Re: How to enable/disable a saved search using Python SDK?

cmerriman — Fri, 05 Jan 2018 12:50:20 GMT

do you mean turning on or off a schedule?

Re: How to enable/disable a saved search using Python SDK?

bollam — Mon, 08 Jan 2018 03:40:09 GMT

Hi @harsmarvania57 ,
I have written code snippet for a basic query validation. Upon successful validation, It should either create, delete, enable or disable the saved search I provide. It was working for creating and deleting the saved search but I'm finding hard to enable or disable the saved search using python SDK. Is there a way to disable or enable the saved search using python SDK?

Re: How to enable/disable a saved search using Python SDK?

bollam — Mon, 08 Jan 2018 03:42:50 GMT

Yes, Exactly

Re: How to enable/disable a saved search using Python SDK?

harsmarvania57 — Mon, 08 Jan 2018 09:19:53 GMT

What's your code snippet ? Have you tried code which I have given in my first comment ?

Re: How to enable/disable a saved search using Python SDK?

paramagurukarth — Mon, 08 Jan 2018 12:27:56 GMT

Please try below..

import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

for ss in service.saved_searches:
    print ss.name
    ss.disable()

Re: How to enable/disable a saved search using Python SDK?

bollam — Tue, 09 Jan 2018 04:41:49 GMT

@ paramagurukarthikeyan, Thanks much!! Its working as expected.

Re: How to enable/disable a saved search using Python SDK?

paramagurukarth — Tue, 16 Jan 2018 07:31:54 GMT

Always Welcome

Re: How to enable/disable a saved search using Python SDK?

bollam — Thu, 18 Jan 2018 07:41:45 GMT

Hi @paramagurukarthikeyan, How do we enable/disable the saved search which contains the special character in it? I'm getting error while trying enable/disable saved search. Saved search I'm trying to disable is "Testing@#splunk". I'm able to create the saved search with this name but disable is not working. Can you help on this as well?

Re: How to enable/disable a saved search using Python SDK?

bollam — Mon, 22 Jan 2018 05:12:50 GMT

Any luck??