topic Saved Search REST End Point in Getting Data In

Saved Search REST End Point

lpolo — Wed, 03 Apr 2013 15:01:12 GMT

The following URI returns the metadata information related to a saved search named "test" found in application "search":

https://myhost:8089/servicesNS/userid/search/saved/searches/test

I would like to know what will be the URI to run the saved search "test" found in application "search" where the returned data format is in json.

Thanks,
Lp

Re: Saved Search REST End Point

gkanapathy — Wed, 03 Apr 2013 21:51:55 GMT

If you want to run a search, you must also specify the view in which it is run, assuming you want to link to it and run it in the UI. ( If you want to just schedule and run in the background without UI, you can use the REST call http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch )

Generally, this URL looks like http://splunkweb:8000/en-US/app/search/flashtimeline?s=test

Re: Saved Search REST End Point

lpolo — Thu, 04 Apr 2013 11:48:26 GMT

It looks like the only way is to dispatch the saved search and then grab the results.
It seems that there is not a way to call the saved search directly, unless; you call the end point to be part of a view like you mentioned.

Re: Saved Search REST End Point

gkanapathy — Thu, 04 Apr 2013 15:21:05 GMT

That is what you would normally do with any search, even just a hardcoded search string, though I suppose you could run those with exec_mode of blocking or oneshot. If that's what you want to do, you can just get the search string for the saved search and dispatch a job using that string in the desired exec_mode.

Re: Saved Search REST End Point

lpolo — Thu, 04 Apr 2013 15:29:00 GMT

I am aware of it. I just wanted know if it is possible to get the results of a saved search with a single REST call.

Re: Saved Search REST End Point

lpolo — Mon, 28 Sep 2020 13:40:27 GMT

I had to simplify the saved search to make it work. why? I do not know. the original saved search works when I dispatch the saved search and grab the results with the sid.

This is an example:
https://myhost.com:8089/services/search/jobs -d search=" savedsearch test" -d exec_mode=oneshot -d output_mode=json . It worked.