topic Re: What is the endpoint I can use for the saved search using API ? in Getting Data In

What is the endpoint I can use for the saved search using API ?

arunsoni — Tue, 18 Sep 2018 20:47:33 GMT

I have a saved search in Splunk. What is the exact URL I need to give to the other team so they can access the saved search along with the result?

The saved search runs for every 30mins and returns the count. So the other application is using REST API to get the count and store in there database for every 30mins.

eg : saved search name is arunsbadmin

what could be the url that I can give to the application team and what is the method to be used(POST or GET) ?

Re: What is the endpoint I can use for the saved search using API ?

lwest_splunk — Wed, 19 Sep 2018 19:46:17 GMT

I found a resource that may be helpful to you in regards to your question:

Video Tutorial by Karen Hodges
https://www.splunk.com/view/SP-CAAAGYH

As well, I found the following documentation if having a readable chunk of text is a better format for you:

From what I have found, it appears the general steps are as follows -

Navigate to the Searches and reports page in your app in Splunk Manager.
Locate your saved search in the list view and click the Permissions link next to it.
Click the box to Share saved search. This moves the search from your user directory to the app's directory.
Optionally set read/write permissions for users in the access control list. Make sure everyone who will be using your dashboard has read permission for any searches shared in that dashboard.

It may also help to have a look at this documentation on Managing Knowledge Objects to see additional info that may relate depending on your specific needs:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/CurateSplunkknowledgewithManager#Make_an_object_available_to_users_of_a_particular_app

I hope this helps!

Re: What is the endpoint I can use for the saved search using API ?

arunsoni — Wed, 19 Sep 2018 20:11:24 GMT

I think you got the question in wrong way.

I have a saved search which runs every 30 mins and get the count value. I need this value to be take by other application. To have the value to other application we are using rest call. I need what could be the url need to given to application team for the rest call

eg : https://localhost:8089//services/saved/searches -- just example but i need the exact URL which should be give for
saved search name is --- arunsbadmin -- please write the url based on the saved search name

Re: What is the endpoint I can use for the saved search using API ?

lwest_splunk — Wed, 19 Sep 2018 20:28:44 GMT

Ah! My apologies! I did misunderstand. Doing a bit more digging around, I was able to find another question similar to this, that had the following information:

Please try:

curl --silent -k -u ':' https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search=" savedsearch "

You can also use the following if you would like the results in CSV format:

curl --silent -k -u ':' https://localhost:8089/servicesNS/admin/search/search/jobs/export?output_mode=csv -d search=" savedsearch "

Does this meet your need a bit better?

Re: What is the endpoint I can use for the saved search using API ?

arunsoni — Thu, 20 Sep 2018 15:01:01 GMT

I need to use it using UI ? The above which you stated is using CLI mode.
Please post me the url to be used using the UI Page . Thanks