Dashboards & Visualizations

How to pass the additional arguments/parameters to the saved search using Splunk Java SDK?

Path Finder

Hi,..

I've implemented the Java SDK for Splunk and I'm able to pass the time arguments and it's working as expected. I'm trying to add additional parms/arguments in the saved search and pass the value from the code. It doesn't work. Which arguments do I need to use to pass the additional parameters?

Saved Search:

source="abc.log" index="index1" | search host=$temp$| stats count(host)

Java Code:

SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.setDispatchEarliestTime("1460590443"); 
dispatchArgs.setDispatchLatestTime("1460703600");
**dispatchArgs.put("temp", "host1");**    

Job jobSavedSearch = null;    
SavedSearch savedSearches1 = service.getSavedSearches().get("SavedSearchName");    
jobSavedSearch = savedSearches1.dispatch(dispatchArgs);

Error :

Exception in thread "main" com.splunk.HttpException: HTTP 400 -- 
 In handler 'savedsearch': Argument "temp" is not supported by this handler.

What arguments should I pass from the code?

Thanks

0 Karma

It works if add "args." before argument name. For example the saved search (with the name "findSurname") is:

host=my_host field1=$args.surname$

then you can do:

    SavedSearch savedSearch = splunkService.getSavedSearches().get("findSurname"); //get your saved search by name

    SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
   dispatchArgs.add("args.surname", "IVAN*");

    Job job = savedSearch.dispatch(dispatchArgs);

    while(!job.isDone()){
        try {
            Thread.sleep(500);
        } catch (InterruptedException ex) {
            System.out.println("Waiting thread was interrupted: " + ex.toString());
        }
    }

    try{
        Args outputArgs = new Args();
        outputArgs.put("output_mode","json");

        InputStream inputStream = job.getEvents(outputArgs);
        byte[] buffer = new byte[4096];

        while(inputStream.read(buffer)!=-1){
            System.out.println(new String(buffer));
        }
    }catch(Exception ex){
        System.out.println("Error getting result from Splunk: " + ex.toString());
    }

Also you can see some examples about saved searches with Splunk SDK here: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY

0 Karma