topic Re: Splunk Rest API call in Getting Data In

Splunk Rest API call

sibanandapani — Tue, 05 Nov 2013 00:21:30 GMT

We need to have a rest service to our saved searches, where we can pass the start time and end time and the name of the search and it can trigger the the search. and it should send an email too..will this be possible?

Re: Splunk Rest API call

psanford_splunk — Tue, 05 Nov 2013 03:33:03 GMT

Hi - Have you seen the saved search REST API docs? http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch

We also have examples in our SDKs.

Java: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY#runsavedargs

C#: http://dev.splunk.com/view/csharp-sdk/SP-CAAAEQF#runsavedargs

Re: Splunk Rest API call

mhorbul — Wed, 05 Feb 2014 22:26:34 GMT

The mentioned doc explains how to create/update/delete "saved search". But seems like that API does not allow to enable/disable action.email and enable/disable a schedule of that search. Am I missing something or I have to go to Web UI and check the checkboxes in order to enable/disable those options ?

Re: Splunk Rest API call

psanford_splunk — Thu, 06 Feb 2014 00:44:10 GMT

For scheduling: Check out these links:

http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Freschedule

http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fscheduled_times

Check the scheduled_times attribute for a list of epoch times.

Re: Splunk Rest API call

mhorbul — Thu, 06 Feb 2014 01:40:40 GMT

I am not talking about rescheduling but about enabling "Schedule Alert" feature

http://goo.gl/n9OKfu

and also "Enable Email" checkbox inside

http://goo.gl/7dTI3x