topic Syntax to update my scheduled search using REST? in Getting Data In

Syntax to update my scheduled search using REST?

the_wolverine — Fri, 04 Mar 2016 17:26:11 GMT

I'm trying to update the max_concurrent instances on my scheduled search from the default of 1 to 2. But the REST command doesn't appear to be working.

curl -k -u admin:changeme https://splunk:8089/servicesNS/admin/search/saved/searches/test_search -d 'max_concurrent=2' -d sharing=app

(Note: the url is correct)

Can someone spot the issue in my curl command?

Re: Syntax to update my scheduled search using REST?

somesoni2 — Fri, 04 Mar 2016 19:16:10 GMT

Try without the single quotes for max_concurrent as well.

curl -k -u admin:changeme https://splunk:8089/servicesNS/admin/search/saved/searches/test_search -d max_concurrent=2 -d sharing=app

Re: Syntax to update my scheduled search using REST?

the_wolverine — Sat, 05 Mar 2016 00:02:24 GMT

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">
 In handler 'savedsearch': Argument "sharing" is not supported by this handler.</msg>
  </messages>
</response>

Re: Syntax to update my scheduled search using REST?

ben_leung — Sat, 05 Mar 2016 01:01:27 GMT

Is the argument not applicable when modifying a system configuration?