Web Tools Add-On: How to reschedule saved searches

[Goesta]

I’m trying to figure out a way to update the cron schedule of a saved search using this add-on,
but I’m not really getting anywhere – could someone kindly advise, please?

While this:

| curl
method=GET
user=THEUSER pass=THEPASSWORD
uri=https://localhost:8089/services/saved/searches/THESAVEDSEARCH

returns an XML response just nicely, trying this:

| makeresults count=1 
| eval message="{'cron_schedule':'00 09 * * *'}" 
| curl
uri=https://localhost:8089/servicesNS/reports/search/saved/searches/THESAVEDSEARCH
user=THEUSER pass=THEPASSWORD
method=post
datafield=message

will return an error (btw, splunkauth doesn’t seem to work for us):

“<msg type="ERROR">Argument "{'cron_schedule':'00 09 * * *'}" is not supported by this handler.</msg>”

Also trying to create an URI that directly addresses the saved/searches/{name}/reschedule endpoint fails in any combination I’ve been trying

So, if you have an idea what I’m doing wrong, I’d appreciate any hints 🙂
(btw, we’re using Splunk 7.1.4)

Have a nice day,
Gösta

[jkat54 · Accepted solution]

Hey, you'll need to escape the quotes on the eval in order to pass proper json.

| eval message="{\"jsonQuoted\":\"True\"}"

For example

[Goesta]

While Splunk won't run the query on the updated schedule (yet), which I'll still need to figure out, GETting the saved search now correctly reflects the changes POSTed using this command.
Thanks for the swift response, I appreciate it!

[jkat54]

You may need to hit an endpoint that reloads the configs such as the one linked to from :8000/debug/refresh

Or there's also a "bump" endpoint.

[herbie_53]

Hi,
changing the URI made it work..

uri=https://localhost:8089/servicesNS/nobody/{App Name}/saved/searches/{Saved Search Name}

The report Goesta and I are talking about is shared globally but owned by a specific user. However, looking at the reports page and hovering the link led us to the solution above:

https://localhost:8000/en-US/app/{App Name}/report?s=%2FservicesNS%2Fnobody%2F{App Name}%2Fsaved%2Fsearches%2F{Saved Search Name}

Might just be us not exactly knowing how Splunk stores the config for knowledge objects but could be helpful for others to understand I guess.

[jkat54]

Also version 1.2.3 had a bug in non-splunkauth connections such as the one you're using. I fixed that last week in version 1.2.4.