topic Re: Not able to list out the saved search using REST API in Getting Data In

Not able to list out the saved search using REST API

anoopambli — Mon, 20 Jun 2016 16:14:12 GMT

I am trying to figure out how to execute a saved search and get the results using the REST API. I have created few saved searches, but I'm not able to list them when I try curl -ks -u admin: https://splunkrest:8089/services/saved/searches. It just shows the default searches.

Any specific permission I need to set on the saved search so that they can be used via REST API?

Re: Not able to list out the saved search using REST API

somesoni2 — Mon, 20 Jun 2016 16:28:08 GMT

Give this a try

curl -ks -u admin: https://splunkrest:8089/servicesNS/-/-/saved/searches

Re: Not able to list out the saved search using REST API

anoopambli — Mon, 20 Jun 2016 16:42:45 GMT

I am able to view my saved search properties now. Thanks for your help. When I try to execute REST API call for dispatching the saved search, I get following error message, Any idea?

bash-3.2$ curl -ks -u : https://splunkrestsvc.fmrco.com/servicesNS/-/-/saved/searches/API_Test/dispatch -d force_dispatch=true

<msg type="ERROR">

In handler 'savedsearch': Cannot edit/create a saved search for wildcarded users or applications

Re: Not able to list out the saved search using REST API

anoopambli — Mon, 20 Jun 2016 16:43:18 GMT

In handler 'savedsearch': Cannot edit/create a saved search for wildcarded users or applications is the error message.

Re: Not able to list out the saved search using REST API

somesoni2 — Mon, 20 Jun 2016 17:56:09 GMT

The endpoint is actually this

 https://splunkrestsvc.fmrco.com/servicesNS/USER/APP/saved/searches.

Once you've the property using first curl, grab the owner/author and the app context and use that for your second dispatch curl.

Re: Not able to list out the saved search using REST API

anoopambli — Wed, 22 Jun 2016 16:11:37 GMT

Super cool, that worked. Thanks a ton.