How To Pass Parameters to Saved Search Using Splunklib

Traer001 — Thu, 24 Jun 2021 21:25:08 GMT

Hello,

Does anyone know how to pass parameters to a saved search using the splunklib for the Splunk API?

I am able to use it to get results from my saved searches, but now I would like to be able to pass a variable value to my saved search. I've seen a few examples of people using the "curl" approach, but I wanted to see if there was a way to do this by directly using the splunklib for Python.

This is the snippet of code where I retrieve my saved search and then run it.

number_of_users = 10
search_name = "Find Most Recent Users"
mysavedsearch = service.saved_searches[search_name]
job = mysavedsearch.dispatch()

So if I have a saved search named: Find Most Recent Users

And that search looks like: "index=INDEX host=HOST sourcetype=SOURCETYPE | rex field=_raw "User:(?<user_id>\d+) | where isnotnull(user_id) | head $number_of_users$"

How would I pass the variable "number_of_users" into the above?

topic How To Pass Parameters to Saved Search Using Splunklib in Splunk Search

How To Pass Parameters to Saved Search Using Splunklib