Dashboards & Visualizations

How to pass the additional arguments/parameters to the saved search using Splunk Java SDK?

Kukkadapu
Path Finder

Hi,..

I've implemented the Java SDK for Splunk and I'm able to pass the time arguments and it's working as expected. I'm trying to add additional parms/arguments in the saved search and pass the value from the code. It doesn't work. Which arguments do I need to use to pass the additional parameters?

Saved Search:

source="abc.log" index="index1" | search host=$temp$| stats count(host)

Java Code:

SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.setDispatchEarliestTime("1460590443"); 
dispatchArgs.setDispatchLatestTime("1460703600");
**dispatchArgs.put("temp", "host1");**    

Job jobSavedSearch = null;    
SavedSearch savedSearches1 = service.getSavedSearches().get("SavedSearchName");    
jobSavedSearch = savedSearches1.dispatch(dispatchArgs);

Error :

Exception in thread "main" com.splunk.HttpException: HTTP 400 -- 
 In handler 'savedsearch': Argument "temp" is not supported by this handler.

What arguments should I pass from the code?

Thanks

0 Karma

kirillchokparov
Explorer

It works if add "args." before argument name. For example the saved search (with the name "findSurname") is:

host=my_host field1=$args.surname$

then you can do:

    SavedSearch savedSearch = splunkService.getSavedSearches().get("findSurname"); //get your saved search by name

    SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
   dispatchArgs.add("args.surname", "IVAN*");

    Job job = savedSearch.dispatch(dispatchArgs);

    while(!job.isDone()){
        try {
            Thread.sleep(500);
        } catch (InterruptedException ex) {
            System.out.println("Waiting thread was interrupted: " + ex.toString());
        }
    }

    try{
        Args outputArgs = new Args();
        outputArgs.put("output_mode","json");

        InputStream inputStream = job.getEvents(outputArgs);
        byte[] buffer = new byte[4096];

        while(inputStream.read(buffer)!=-1){
            System.out.println(new String(buffer));
        }
    }catch(Exception ex){
        System.out.println("Error getting result from Splunk: " + ex.toString());
    }

Also you can see some examples about saved searches with Splunk SDK here: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...