All Apps and Add-ons
Highlighted

Web Tools Add-On: How to reschedule saved searches

Explorer

I’m trying to figure out a way to update the cron schedule of a saved search using this add-on,
but I’m not really getting anywhere – could someone kindly advise, please?

While this:

| curl
method=GET
user=THEUSER pass=THEPASSWORD
uri=https://localhost:8089/services/saved/searches/THESAVEDSEARCH

returns an XML response just nicely, trying this:

| makeresults count=1 
| eval message="{'cron_schedule':'00 09 * * *'}" 
| curl
uri=https://localhost:8089/servicesNS/reports/search/saved/searches/THESAVEDSEARCH
user=THEUSER pass=THEPASSWORD
method=post
datafield=message

will return an error (btw, splunkauth doesn’t seem to work for us):

“<msg type="ERROR">Argument "{'cron_schedule':'00 09 * * *'}" is not supported by this handler.</msg>”

Also trying to create an URI that directly addresses the saved/searches/{name}/reschedule endpoint fails in any combination I’ve been trying

So, if you have an idea what I’m doing wrong, I’d appreciate any hints 🙂
(btw, we’re using Splunk 7.1.4)

Have a nice day,
Gösta

Highlighted

Re: Web Tools Add-On: How to reschedule saved searches

SplunkTrust
SplunkTrust

Hey, you'll need to escape the quotes on the eval in order to pass proper json.

| eval message="{\"jsonQuoted\":\"True\"}"

For example

View solution in original post

Highlighted

Re: Web Tools Add-On: How to reschedule saved searches

SplunkTrust
SplunkTrust

Also version 1.2.3 had a bug in non-splunkauth connections such as the one you're using. I fixed that last week in version 1.2.4.

0 Karma
Highlighted

Re: Web Tools Add-On: How to reschedule saved searches

Explorer

While Splunk won't run the query on the updated schedule (yet), which I'll still need to figure out, GETting the saved search now correctly reflects the changes POSTed using this command.
Thanks for the swift response, I appreciate it!

Highlighted

Re: Web Tools Add-On: How to reschedule saved searches

SplunkTrust
SplunkTrust

You may need to hit an endpoint that reloads the configs such as the one linked to from :8000/debug/refresh

Or there's also a "bump" endpoint.

Highlighted

Re: Web Tools Add-On: How to reschedule saved searches

Explorer

Hi,
changing the URI made it work..

uri=https://localhost:8089/servicesNS/nobody/{App Name}/saved/searches/{Saved Search Name}

The report Goesta and I are talking about is shared globally but owned by a specific user. However, looking at the reports page and hovering the link led us to the solution above:

https://localhost:8000/en-US/app/{App Name}/report?s=%2FservicesNS%2Fnobody%2F{App Name}%2Fsaved%2Fsearches%2F{Saved Search Name}

Might just be us not exactly knowing how Splunk stores the config for knowledge objects but could be helpful for others to understand I guess.