topic Re: Can we pass a parameter to a report? in Splunk Search

Can we pass a parameter to a report?

danielbb — Fri, 05 May 2023 15:30:52 GMT

Is there a way to pass a parameter to a report when calling it via -

curl -u user:password -k https://<api_server>:8089/servicesNS/nobody/<app_name>/search/jobs -d "search=savedsearch <savedsearch_name>" -d exec_mode=oneshot -d count=10000

Re: Can we pass a parameter to a report?

yuanliu — Sat, 06 May 2023 05:49:54 GMT

Depending on what you want to pass - or, in an awkward way to say it, where you want to pass into. You cannot change SPL in a saved search when calling it. There are limited ways to influence the output by passing CGI variables in GET method. The most obvious, and arguably the most useful one is earliest and latest. To do so, you will need to save with Time Range Picker "Yes"; and the SPL in the saved search must not have override to earliest and latest.

Re: Can we pass a parameter to a report?

ldongradi_SPL — Fri, 23 Jan 2026 14:33:00 GMT

YES

Assuming the search was saved with an SPL including a token, like $myvar$, you can call the report (aka saved search) in SPL with that syntax: | savedsearch myreport myvar=1000

Example:

| makeresults count=10 -> generates 10 stats events

| makeresults count=$myvar$ -> saved as a report named myreport

| savedsearch myreport myvar=1000 -> will run the saved search for 1000 events

Note:

If you omit to name the expected variable when calling the saved search, you'd end up with an error. The report now expects the variable(s) to be mentioned an any run.

You can call then the saved search in CLI from the Search Head (or locally to an indexer):

/opt/splunk/bin/splunk search '| savedsearch myreport myvar=10'

or from a REST call:

curl -u user:password -k https://<api_server>:8089/servicesNS/nobody/<app_name>/search/jobs -d "search=savedsearch myreport myvar=1000" -d exec_mode=oneshot

You can also use the saved search from a Dashboard, at least from XML.

Re: Can we pass a parameter to a report?

yuanliu — Fri, 23 Jan 2026 06:19:05 GMT

This is very useful information! Meanwhile, Splunk equates "saved search" with "Report". If you save a search with token, the saved search can no longer be used as Report because the common sense of a Report is such that you open it and see output. In such use, the "saved search" is very much just another way of saving a macro.