topic Re: How do you create saved search using REST API call? in Getting Data In

How do you create saved search using REST API call?

sp04355 — Thu, 13 Dec 2018 00:16:33 GMT

Works in curl:

curl -k -u admin:changeme http://localhost:8089/servicesNS/admin/search/saved/searches -d name=MySavedSearch --data-urlencode search="index=_internal source=*metrics.log"

The same call from Postman:

http://localhost:8089//servicesNS/admin/launcher/saved/searches?name="MySavedSearch"&search="index=_internal source=*metrics.log"

< ERROR">Cannot perform action "POST" without a target name to act on.

What is the target name it complains about? I provided an application name as a target — not good enough?

Re: How do you create saved search using REST API call?

sp04355 — Fri, 14 Dec 2018 18:00:14 GMT

Should i add a stanza to the input.conf?
I have the same issue on create index as well.
Please, Splunk gurus? Anybody knows the answer?

Re: How do you create saved search using REST API call?

whrg — Sat, 15 Dec 2018 15:49:55 GMT

Hello @sp04355,

Do you know the distinction between GET and POST requests? If not, you should probably google it. One important difference is that GET parameters are sent as part of the URL whereas POST parameters are sent in the request body after the HTTP headers.

When you browse the REST API Reference Manual then you will see that there are many functions which depend on the type of the request (GET, POST, DELETE...). GET is usually for requesting data whereas POST is for making changes.

Your curl command above will run a POST request which looks like this:

POST /servicesNS/admin/search/saved/searches HTTP/1.1
Authorization: Basic ...
User-Agent: curl/...
Host: localhost
Accept: */*
Content-Length: 66
Content-Type: application/x-www-form-urlencoded

name=MySavedSearch&search=index%3D_internal%20source%3Dmetrics.log

Now I'm not familiar with Postman but from what I can see: You are explicitly putting the parameters in the URL instead of the request body. So you are sending a POST request without any valid parameters. That's why Splunk is complaining that it cannot find the "name=MySavedSearch" parameter.

So I advice to check the Postman documentation on how to send a POST request.

Side note 1: Why do you have "launcher" in the postman URL?
Side note 2: I'm surprised to see that you are using http instead of https.

Re: How do you create saved search using REST API call?

paulstark2 — Tue, 09 Feb 2021 17:53:38 GMT

curl -k -u admin:changeme https://localhost:8089/services/saved/searches \ -d name=firstApiTest \ -d disabled=1 \ -d owner=nobody \ -d description=descritionText \ -d search="index=main" \ -d dispatch.index_earliest=-7d \ -d dispatch.index_latestlatest=now

Re: How do you create saved search using REST API call?

gerrysr6 — Mon, 10 Jul 2023 17:48:34 GMT

what the heck is a stanza?

Re: How do you create saved search using REST API call?

damode1 — Thu, 31 Aug 2023 05:12:00 GMT

Is there a way to pass these values from a file?

	-d name=firstApiTest \
	-d disabled=1 \
	-d owner=nobody \
	-d description=descritionText \
	-d search="index=main" \
	-d dispatch.index_earliest=-7d \
	-d dispatch.index_latestlatest=now