topic Re: Executing a saved search and on-demand search using REST API in Splunk Search

Executing a saved search and on-demand search using REST API

amit_saxena — Thu, 08 Aug 2013 18:29:44 GMT

Hi all,

I would like to execute a saved search and also an on-demand hard-coded search using REST API.

While I found a way to execute a hard-coded search, I haven't found a way to execute a saved search using REST API.

Please let me know how to achieve the same.

Regards,
Amit Saxena

Re: Executing a saved search and on-demand search using REST API

psanford_splunk — Thu, 08 Aug 2013 19:54:05 GMT

Which language are you using? If you are using a language that we have an SDK for, then I would go that route. Info on SDKs is here: http://dev.splunk.com/view/sdks/SP-CAAADP7

If you want to do it via the REST API - then take a look at these two tutorials:

http://dev.splunk.com/view/SP-CAAADQ5
http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK

REST API reference docs for saved searches are here: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2Fdispatch

You can call dispatch for the search you care about and then you should be off and running.

Re: Executing a saved search and on-demand search using REST API

amit_saxena — Fri, 09 Aug 2013 11:58:22 GMT

Hi,

Thanks, that worked for me !

Regards,
Amit Saxena