Alerting

expose alerts with API

Path Finder

Hello

How can I expose alerts using the API ?
i've created a saved searches.

thanks

Tags (3)
0 Karma

SplunkTrust
SplunkTrust

Can you please provide some more info ? What you want to do with alerts using REST API For example: Modify or Run ?

0 Karma

Path Finder

run. the same as it will be with the console

0 Karma

SplunkTrust
SplunkTrust

Have a look at Splunk SDK document https://dev.splunk.com/enterprise/docs/python/sdk-python/howtousesplunkpython/howtorunsearchespython... (SDK available in Python, C#, Java & Javascript)

0 Karma

Path Finder

thanks, it is an interesting option but it is not what im looking for.
i need to run it with some tool like postman

0 Karma

Path Finder

thanks. i already read it. maybe im missing something but it is not working

0 Karma

SplunkTrust
SplunkTrust

In that case you need to provide more details, what have you tried (Like which REST API are you using with search query), what errors are you getting.

0 Karma

Path Finder

i don't see an option to run the alert. i see an option to see the fired alerts or alerts actions.
get you please give me an example of how to run an alert ? even from command line

0 Karma

SplunkTrust
SplunkTrust

I don't have postman installed so can't give you postman example but if you look at documentation https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTsearch#search.2Fjobs.2Fexport, they have provided below example

curl -k -u admin:password https://splunkserver:8089/services/search/jobs/export -d search="savedsearch \ MySavedSearch%20host%3Dwolverine*"

Additionally have a look at https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTTUT/RESTsearches

0 Karma

Path Finder

im getting this error :

curl: (6) Could not resolve host: splunkserver

0 Karma

SplunkTrust
SplunkTrust

You need to replace splunkserver with your actual splunk server hostname or ip address.

0 Karma

Path Finder

ohhh oopssss
but anyway, im getting an error:
this is my command:

curl -k -u admin:1qaz@wsx https://localhost:8089/services/search/jobs/export -d search="savedsearch \ DeletedLuckyCart"

this is the error :

Error in 'savedsearch' command: Unable to find saved search named '\'.

0 Karma