How to enable and disable scheduled searches using Splunk REST API in Powershell?

vivekriyer — Thu, 22 Sep 2016 22:25:30 GMT

I have a requirement to disable scheduled search (specific ones) during a specific window and when a data load runs, enable it back on once the load is completed.
I have a limitation of running it Powershell. I went through couple of Answers posts and was not able to find a post related to Powershell implementation.

Thanks in advance.

Re: How to enable and disable scheduled searches using Splunk REST API in Powershell?

acharlieh — Thu, 22 Sep 2016 23:19:47 GMT

I am not a powershell user... however it looks like there's a cmdlet to Invoke a HTTP Rest service, namely Invoke-RestMethod: https://technet.microsoft.com/en-us/library/hh849971.aspx

In fact the documentation on that page has an example of performing a POST request that's using the Splunk API to execute a Splunk search and getting results from it.

Armed with this, and the Splunk REST reference, it should be only minor modifications to the $Url and $Body arguments to then be able to modify your saved search (to schedule / unschedule it at whim): http://docs.splunk.com/Documentation/Splunk/6.4.3/RESTREF/RESTsearch#POST_saved.2Fsearches.2F.7Bname.7D_method_detail

topic How to enable and disable scheduled searches using Splunk REST API in Powershell? in Getting Data In

How to enable and disable scheduled searches using Splunk REST API in Powershell?

Re: How to enable and disable scheduled searches using Splunk REST API in Powershell?