Splunk Dev

REST API call to run a saved search with macro replacement?

Lowell
Super Champion

Is there a way to directly launch a saved search via the scheduler while passing key/value pairs for macro replacement via an API call?

The only place I've seen any reference to macro replacements for saved search is with the savedsearch search command documentation, and it's fairly brief. So I haven't seen anything that talks about how to do this, but that's not too surprising.

Just for the reccord, (because I'm sure someone will point it out)... Simply running a search of "| savedsearch mysavedsearch key=value" is not an option in my particular use case. I need any triggered actions associated with the saved search to be run, and the only way I know of doing that is via the scheduler. So I believe that rules out the possibility of using the savedsearch search command.

My ultimate goal is to do this from Splunk's python API. I can launch a saved search with the scheduler like so, the only piece I'm missing is how to pass in values for macro expansion. Any ideas?

import splunk.saved
job = splunk.saved.dispatchSavedSearch("mysavedsearch", sessionKey=sessionKey, namespace="myapp", owner="owner", triggerActions="1", now=timestamp)

Related stuff:

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no facility for setting the saved search replacement parameters via the API.

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no facility for setting the saved search replacement parameters via the API.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...