Dashboards & Visualizations

How to pass the additional arguments/parameters to the saved search using Splunk Java SDK?

Kukkadapu
Path Finder

Hi,..

I've implemented the Java SDK for Splunk and I'm able to pass the time arguments and it's working as expected. I'm trying to add additional parms/arguments in the saved search and pass the value from the code. It doesn't work. Which arguments do I need to use to pass the additional parameters?

Saved Search:

source="abc.log" index="index1" | search host=$temp$| stats count(host)

Java Code:

SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.setDispatchEarliestTime("1460590443"); 
dispatchArgs.setDispatchLatestTime("1460703600");
**dispatchArgs.put("temp", "host1");**    

Job jobSavedSearch = null;    
SavedSearch savedSearches1 = service.getSavedSearches().get("SavedSearchName");    
jobSavedSearch = savedSearches1.dispatch(dispatchArgs);

Error :

Exception in thread "main" com.splunk.HttpException: HTTP 400 -- 
 In handler 'savedsearch': Argument "temp" is not supported by this handler.

What arguments should I pass from the code?

Thanks

0 Karma

kirillchokparov
Explorer

It works if add "args." before argument name. For example the saved search (with the name "findSurname") is:

host=my_host field1=$args.surname$

then you can do:

    SavedSearch savedSearch = splunkService.getSavedSearches().get("findSurname"); //get your saved search by name

    SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
   dispatchArgs.add("args.surname", "IVAN*");

    Job job = savedSearch.dispatch(dispatchArgs);

    while(!job.isDone()){
        try {
            Thread.sleep(500);
        } catch (InterruptedException ex) {
            System.out.println("Waiting thread was interrupted: " + ex.toString());
        }
    }

    try{
        Args outputArgs = new Args();
        outputArgs.put("output_mode","json");

        InputStream inputStream = job.getEvents(outputArgs);
        byte[] buffer = new byte[4096];

        while(inputStream.read(buffer)!=-1){
            System.out.println(new String(buffer));
        }
    }catch(Exception ex){
        System.out.println("Error getting result from Splunk: " + ex.toString());
    }

Also you can see some examples about saved searches with Splunk SDK here: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...