Splunk Dev

REST API call to run a saved search with macro replacement?

Lowell
Super Champion

Is there a way to directly launch a saved search via the scheduler while passing key/value pairs for macro replacement via an API call?

The only place I've seen any reference to macro replacements for saved search is with the savedsearch search command documentation, and it's fairly brief. So I haven't seen anything that talks about how to do this, but that's not too surprising.

Just for the reccord, (because I'm sure someone will point it out)... Simply running a search of "| savedsearch mysavedsearch key=value" is not an option in my particular use case. I need any triggered actions associated with the saved search to be run, and the only way I know of doing that is via the scheduler. So I believe that rules out the possibility of using the savedsearch search command.

My ultimate goal is to do this from Splunk's python API. I can launch a saved search with the scheduler like so, the only piece I'm missing is how to pass in values for macro expansion. Any ideas?

import splunk.saved
job = splunk.saved.dispatchSavedSearch("mysavedsearch", sessionKey=sessionKey, namespace="myapp", owner="owner", triggerActions="1", now=timestamp)

Related stuff:

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no facility for setting the saved search replacement parameters via the API.

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no facility for setting the saved search replacement parameters via the API.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...