Alerting

expose alerts with API

sarit_s
Communicator

Hello

How can I expose alerts using the API ?
i've created a saved searches.

thanks

Tags (3)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Can you please provide some more info ? What you want to do with alerts using REST API For example: Modify or Run ?

0 Karma

sarit_s
Communicator

run. the same as it will be with the console

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Have a look at Splunk SDK document https://dev.splunk.com/enterprise/docs/python/sdk-python/howtousesplunkpython/howtorunsearchespython... (SDK available in Python, C#, Java & Javascript)

0 Karma

sarit_s
Communicator

thanks, it is an interesting option but it is not what im looking for.
i need to run it with some tool like postman

0 Karma

sarit_s
Communicator

thanks. i already read it. maybe im missing something but it is not working

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

In that case you need to provide more details, what have you tried (Like which REST API are you using with search query), what errors are you getting.

0 Karma

sarit_s
Communicator

i don't see an option to run the alert. i see an option to see the fired alerts or alerts actions.
get you please give me an example of how to run an alert ? even from command line

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

I don't have postman installed so can't give you postman example but if you look at documentation https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTsearch#search.2Fjobs.2Fexport, they have provided below example

curl -k -u admin:password https://splunkserver:8089/services/search/jobs/export -d search="savedsearch \ MySavedSearch%20host%3Dwolverine*"

Additionally have a look at https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTTUT/RESTsearches

0 Karma

sarit_s
Communicator

im getting this error :

curl: (6) Could not resolve host: splunkserver

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

You need to replace splunkserver with your actual splunk server hostname or ip address.

0 Karma

sarit_s
Communicator

ohhh oopssss
but anyway, im getting an error:
this is my command:

curl -k -u admin:1qaz@wsx https://localhost:8089/services/search/jobs/export -d search="savedsearch \ DeletedLuckyCart"

this is the error :

Error in 'savedsearch' command: Unable to find saved search named '\'.

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...