topic Re: How to execute a saved search using Splunk's REST API in Splunk Search

How to execute a saved search using Splunk's REST API

subhashishfid — Tue, 02 May 2017 16:03:10 GMT

I know this question has been asked a few times but none of the answers seem to work for me.
I have a saved search called usernameSearch and want to execute it synchronously using Splunk's REST API.

Executing POST https://localhost:8089/services/saved/searches/usernameSearch/dispatch gives me the following response but not the results of the search. How can I possibly get the result synchronously ?

<sid>admin__admin__twsdashboard__usernameSearch_at_1493721538_18</sid>

Re: How to execute a saved search using Splunk's REST API

hhGA — Wed, 03 May 2017 13:12:41 GMT

Hi,

Please try:
curl --silent -k -u '<username>:<password>' https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search=" savedsearch <saved_search_name>"

You can also use the following if you would like the results in CSV format:

curl --silent -k -u '<username>:<password>' https://localhost:8089/servicesNS/admin/search/search/jobs/export?output_mode=csv -d search=" savedsearch <saved_search_name>"

Kind regards,

Re: How to execute a saved search using Splunk's REST API

subhashishfid — Wed, 03 May 2017 13:21:39 GMT

Thanks a lot. This works perfectly !

Re: How to execute a saved search using Splunk's REST API

hhGA — Wed, 03 May 2017 13:26:52 GMT

You're welcome.

Re: How to execute a saved search using Splunk's REST API

AlisonHaire — Wed, 16 May 2018 04:48:23 GMT

I assume you're looking for more like a fetch call??

Using the npm library axios I would do

axios.get(url, {
  auth: {username: 'username', password: 'password'},
  params: {output_mode: 'json', 'search': 'savedsearch usernameSearch'},
})
.then((response)=>{
  console.log(response);
})
.catch((err)=>{
  console.log('err', err);
});

Re: How to execute a saved search using Splunk's REST API

vasanthi77 — Tue, 03 Sep 2019 01:41:04 GMT

@hhGA I m trying to get saved search results from browser, so i m using below url

https://hostname:8089/servicesNS/nobody/OMEGA/search/jobs/export?output_mode=json&count=1&search=savedsearch <savedsearch_name>

I m getting below output , anyidea wht is wrong here

{"preview":false,"lastrow":true}

Re: How to execute a saved search using Splunk's REST API

simon_lavigne — Wed, 29 Jan 2020 10:48:08 GMT

{"preview":false,"lastrow":true} is returned when the saved search has 0 results.

Re: How to execute a saved search using Splunk's REST API

revanthammineni — Thu, 18 Mar 2021 18:31:50 GMT

Hi.

I’m having an issue related to my savedsearch. I created a saved search and scheduled it. But it is not showing up when try with the API endpoint.

/search/saved/searches.

I can only see few of the reports.

any recommendations?

TIA.