Set default app in ruby api?

st0kes — Tue, 06 Aug 2013 08:41:32 GMT

The below code snippet will only work if my saved search is saved in the default "search" app.

query = "My Saved Query"
saved_search = splunkService.saved_searches.fetch("#{query}")
search_job = saved_search.dispatch()

How do I modify this so this it will get the query from the "mycustom_app" app? I've experimented with various ideas but nothing seems to work.

Re: Set default app in ruby api?

psanford_splunk — Tue, 06 Aug 2013 21:46:36 GMT

Hi - This trick is to set the namespace in order to pull back the saved search that you want. Also - there is a "bug" in our docs for pulling back metadata of a saved search. NOTE: in the example below I am not using a : to pull back the description of the saved search. We are working to get that corrected ASAP.

Here is the snippet to create a namespace object and then to connect to splunk in that namespace.

ns = Splunk::namespace(:sharing => "app", :app => "testrubySS")
svc = Splunk::connect(:username => 'admin', :password => 'changed', :namespace => ns)

Here is my full example that you can use to test out and see if your namespace has been limited. For example, when you list saved searches prior to applying the namespace you will see everything that is system.

After applying namespace you will just see the saved searches in that app.

require 'splunk-sdk-ruby'

class MyTest

  def initialize()

end

def run

ns = Splunk::namespace(:sharing => "app", :app => "testrubySS")

svc = Splunk::connect(:username => 'admin', :password => 'changed', :namespace => ns)

svc.apps.each do |a|

  puts "App name is: #{a.name}"

end

svc.saved_searches.each do |saved_search|

  puts "Saved search is: #{saved_search.name}" 

end

ruby_ss = svc.saved_searches.fetch("my_ruby_search")

if ruby_ss.nil?
  puts "COULDN'T GET THE SAVED SEARCH"
else
 puts "Description for #{ruby_ss.fetch('description')}"

 testJob = ruby_ss.dispatch()

end

end

end

test = MyTest.new()
test.run

Re: Set default app in ruby api?

st0kes — Wed, 07 Aug 2013 07:27:27 GMT

Brilliant answer, thanks.

topic Set default app in ruby api? in Getting Data In

Set default app in ruby api?

Re: Set default app in ruby api?

Re: Set default app in ruby api?