topic Re: How to use the REST API to fetch and filter results from a saved search? in Splunk Search

How to use the REST API to fetch and filter results from a saved search?

samkaj — Thu, 19 May 2016 08:57:26 GMT

I am using REST service - my requirement is to use Splunk REST URL to fetch details from a saved search .. but I want a filter while fetching details. How can I do this?

Re: How to use the REST API to fetch and filter results from a saved search?

MuS — Thu, 19 May 2016 22:47:40 GMT

You should provide more details on this, like do you want to query the details of the saved search and filter the details or do you want to get back the search results of a saved search and filter on the search results?

cheers, MuS

Re: How to use the REST API to fetch and filter results from a saved search?

woodcock — Sun, 29 May 2016 01:23:47 GMT

Look here:

http://docs.splunk.com/Documentation/Splunk/6.0.9/RESTAPI/RESTsearches#Get_search_results

So from the search bar, like this:

| rest services/search/jobs/<HereIsYourJobID>/results/  | <your filter stuff here>

Re: How to use the REST API to fetch and filter results from a saved search?

AnujaJ — Tue, 05 Mar 2019 11:23:25 GMT

Here:
https://www.splunk.com/blog/2013/06/18/getting-data-from-your-rest-apis-into-splunk.html#

I used this App. Very simple to configure.

Re: How to use the REST API to fetch and filter results from a saved search?

JL99 — Tue, 12 Mar 2024 17:05:00 GMT

Here is my sample. I want to get all saved search then from the returned result I want to filter in the field called "search" to find searchstring that contains something like "| collect".

So

| where (search LIKE "%| collect%")

do the job

Full Search String:

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search | where (search LIKE "%| collect%")

Add-On
Let's say I want to filter search a field called "action.summary_index" for the value equals to 1, I can do as below. Enclose the field name with dollar sign ($)

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
| where $action.summary_index$ = "1"