topic Re: Examples of using variable in REST API search? Is it possible? in Getting Data In

Examples of using variable in REST API search? Is it possible?

the_wolverine — Thu, 03 Jan 2013 01:00:59 GMT

Are there any examples of how to pass a variable to query when using REST API?

Re: Examples of using variable in REST API search? Is it possible?

dart — Thu, 03 Jan 2013 10:26:57 GMT

Can you expand upon your use case? I'm not clear on what you mean by a variable.

Re: Examples of using variable in REST API search? Is it possible?

the_wolverine — Thu, 03 Jan 2013 18:06:47 GMT

For example, I want to create a search that accepts a variable input (e.g. IP address) so I can reuse it. After thinking more about this, looks like I can pre-populate Splunk with saved searches that accept such a variable but it would be nice to see cool examples of how other customers have done this.

Re: Examples of using variable in REST API search? Is it possible?

the_wolverine — Mon, 07 Jan 2013 22:50:09 GMT

Here's an example of running a saved search and passing a variable to it. In this case, the variable is host field:

$curl -k -u admin:password https://splunkserver:8089/services/search/jobs/export -d search="savedsearch \ MySavedSearch%20host%3Dwolverine*"

(use "MySavedSearch" and input variable host=wolverine* )

I have a saved search named "MySavedSearch" the query of the search contains:

"index=main $host$ | head 100"

I wish there were more examples like this in the documentation so I am providing it here in hopes that it can help someone else.