topic Re: Does anyone know how to convert a savedsearch request to a REST API endpoint request? in Getting Data In

Does anyone know how to convert a savedsearch request to a REST API endpoint request?

kmugglet — Mon, 28 Sep 2020 18:17:27 GMT

Does anyone know how to convert this savedsearch request to a REST endpoint request?

|savedsearch mysearch replace_me="value"

I can run a normal savedsearch "apm_cvc_qtr_bh_test" using curl in the app apm_snpm

curl -k -u svc_user_bob:password https://localhost:8089/servicesNS/svc_user_bob/apm_snpm/saved/searches/apm_cvc_qtr_bh_test/dispatch -d trigger_actions=1

but i don't know how to pass the replace_me key and value

Any ideas?

Re: Does anyone know how to convert a savedsearch request to a REST API endpoint request?

somesoni2 — Tue, 02 Dec 2014 21:33:47 GMT

See this example

http://answers.splunk.com/answers/8945/how-to-start-a-saved-search-using-rest-api.html

you can just give your "|savedsearch" command as search query in curl.

Re: Does anyone know how to convert a savedsearch request to a REST API endpoint request?

kmugglet — Wed, 03 Dec 2014 00:01:26 GMT

Thanks, but I couldn't see in there how to pass the values for a template search...

Re: Does anyone know how to convert a savedsearch request to a REST API endpoint request?

kmugglet — Wed, 03 Dec 2014 00:02:49 GMT

For the rest call

curl -k u user:password https://blah.local:8089/servicesNS/svc_usr_bob/apm_snpm/saved/searches/apm_cvc_qtr_bh_test/dispatch -d trigger_actions=1 -d args.startDate="-3d" -d args.endDate="-0d"

in the saved search

eventtype=service-CombinedForwardingPlaneQueueGroupServiceIngressLogRecord earliest=$args.startDate$ latest=$args.endDate$

I should work for the NSA after decrypting the Splunk doco