topic Re: How to disable scheduled searches via command line interface? in Reporting

How to disable scheduled searches via command line interface?

pfernandez133 — Wed, 22 Oct 2014 01:28:10 GMT

Hey guys, I'm looking for a way to disable multiple scheduled searches via command line.

Once a week, we switch one environment on and the other off, so we want to disable searches/alerts for the environment we've disabled. As you may have guessed, it's quite a few searches/alerts that need to be disabled. A command-line method would allow me to script it.

Thanks in advance!

Re: How to disable scheduled searches via command line interface?

Ledion_Bitincka — Wed, 22 Oct 2014 06:58:20 GMT

you can use the REST endpoint directly either through curl or by programming against it using the SDKs to

curl -ku admin:changeme https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

 eg 

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"

Re: How to disable scheduled searches via command line interface?

pfernandez133 — Wed, 22 Oct 2014 20:50:48 GMT

Thanks for the suggestion!

I had to set "is_scheduled=true" to get it to flip from 0 to 1, but the search's status is still set to disabled under Manager > Searches and Reports. How can I switch that disabled to enabled?

Thx again!

Re: How to disable scheduled searches via command line interface?

Ledion_Bitincka — Wed, 22 Oct 2014 23:30:15 GMT

You should be able to do that by:

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar/enable -d ""

Learn more about our REST API

Re: How to disable scheduled searches via command line interface?

jrodman — Thu, 23 Oct 2014 04:00:05 GMT

To be clear, this disables the scheduling aspect, or alert, of the search, instead of disabling the whole search. I think it's the best option for your goal though.

Re: How to disable scheduled searches via command line interface?

lmyrefelt — Thu, 23 Oct 2014 08:39:16 GMT

You can also disabled "scheduling capability" in $SPLUNK_HOME/etc/system/{local,default}/default-mode.conf
No scheduled searches willl run ... "ever" on this server.

[pipeline:scheduler]
disabled = true

Re: How to disable scheduled searches via command line interface?

jkat54 — Wed, 17 Jul 2019 13:10:33 GMT

Let's get out of the habit of adding a password to our curls, which would then end up in os logs.

curl -ku admin https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

curl -ku admin https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"

The above will prompt you for password and not reveal it to the world of shoulder surfers and history buffs.

Re: How to disable scheduled searches via command line interface?

pretzel2 — Wed, 17 Mar 2021 14:22:30 GMT

Help vote up these new feature ideas .. which is for Splunk to create an app or feature within to product to schedule reoccurring disablement of certain scheduled searches/alerts/reports.

https://ideas.splunk.com/ideas/EID-I-181

https://ideas.splunk.com/ideas/EID-I-654