<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to query against Splunk API a saved search without the search Id? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276649#M53039</link>
    <description>&lt;P&gt;You did not describe what your IDE or language are but Splunk SDK dox are here:&lt;BR /&gt;
 &lt;A href="http://dev.splunk.com/view/sdks/SP-CAAADP7"&gt;http://dev.splunk.com/view/sdks/SP-CAAADP7&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;If you want to do it via the REST API - then take a look at these two tutorials:&lt;BR /&gt;
&lt;A href="http://dev.splunk.com/view/SP-CAAADQ5"&gt;http://dev.splunk.com/view/SP-CAAADQ5&lt;/A&gt;&lt;BR /&gt;
&lt;A href="http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK"&gt;http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;REST API reference docs for saved searches are here:  &lt;A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch"&gt;http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;You call &lt;CODE&gt;dispatch&lt;/CODE&gt; for the search you care about and then you should be off and running.  &lt;/P&gt;</description>
    <pubDate>Wed, 01 Mar 2017 01:50:41 GMT</pubDate>
    <dc:creator>woodcock</dc:creator>
    <dc:date>2017-03-01T01:50:41Z</dc:date>
    <item>
      <title>How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276644#M53034</link>
      <description>&lt;P&gt;Can someone suggest how to query against Splunk API for a saved search without the Search Id? Basically we have a requirement to make a call against Splunk API (REST) for a saved search and get results.&lt;/P&gt;</description>
      <pubDate>Fri, 03 Feb 2017 18:46:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276644#M53034</guid>
      <dc:creator>Mathanjey</dc:creator>
      <dc:date>2017-02-03T18:46:14Z</dc:date>
    </item>
    <item>
      <title>Re: How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276645#M53035</link>
      <description>&lt;P&gt;So you want to run the saved search or want to get information about the saved search (and what information if yes)?&lt;/P&gt;</description>
      <pubDate>Fri, 03 Feb 2017 18:53:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276645#M53035</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2017-02-03T18:53:49Z</dc:date>
    </item>
    <item>
      <title>Re: How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276646#M53036</link>
      <description>&lt;P&gt;What he asked.&lt;/P&gt;</description>
      <pubDate>Wed, 22 Feb 2017 00:33:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276646#M53036</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-02-22T00:33:16Z</dc:date>
    </item>
    <item>
      <title>Re: How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276647#M53037</link>
      <description>&lt;P&gt;I have a saved search and wanted to invoke the saved search via rest api and get results from the api.&lt;/P&gt;</description>
      <pubDate>Wed, 22 Feb 2017 13:47:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276647#M53037</guid>
      <dc:creator>Mathanjey</dc:creator>
      <dc:date>2017-02-22T13:47:55Z</dc:date>
    </item>
    <item>
      <title>Re: How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276648#M53038</link>
      <description>&lt;P&gt;You can first list all your saved Searches like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest services/search/jobs | search isSavedSearch=1 | stats count by label
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;then you can specifically interrogate them if needed&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rest services/search/jobs | search label="my special saved search"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 24 Feb 2017 11:29:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276648#M53038</guid>
      <dc:creator>koshyk</dc:creator>
      <dc:date>2017-02-24T11:29:38Z</dc:date>
    </item>
    <item>
      <title>Re: How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276649#M53039</link>
      <description>&lt;P&gt;You did not describe what your IDE or language are but Splunk SDK dox are here:&lt;BR /&gt;
 &lt;A href="http://dev.splunk.com/view/sdks/SP-CAAADP7"&gt;http://dev.splunk.com/view/sdks/SP-CAAADP7&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;If you want to do it via the REST API - then take a look at these two tutorials:&lt;BR /&gt;
&lt;A href="http://dev.splunk.com/view/SP-CAAADQ5"&gt;http://dev.splunk.com/view/SP-CAAADQ5&lt;/A&gt;&lt;BR /&gt;
&lt;A href="http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK"&gt;http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;REST API reference docs for saved searches are here:  &lt;A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch"&gt;http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;You call &lt;CODE&gt;dispatch&lt;/CODE&gt; for the search you care about and then you should be off and running.  &lt;/P&gt;</description>
      <pubDate>Wed, 01 Mar 2017 01:50:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276649#M53039</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-03-01T01:50:41Z</dc:date>
    </item>
    <item>
      <title>Re: How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276650#M53040</link>
      <description>&lt;P&gt;Did you try this?&lt;/P&gt;</description>
      <pubDate>Sat, 25 Mar 2017 10:23:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276650#M53040</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-03-25T10:23:03Z</dc:date>
    </item>
    <item>
      <title>Re: How to query against Splunk API a saved search without the search Id?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276651#M53041</link>
      <description>&lt;P&gt;Are you OK now?&lt;/P&gt;</description>
      <pubDate>Sat, 25 Mar 2017 10:23:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-query-against-Splunk-API-a-saved-search-without-the/m-p/276651#M53041</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2017-03-25T10:23:13Z</dc:date>
    </item>
  </channel>
</rss>

