Dashboards & Visualizations

How to pass the additional arguments/parameters to the saved search using Splunk Java SDK?

Kukkadapu
Path Finder

Hi,..

I've implemented the Java SDK for Splunk and I'm able to pass the time arguments and it's working as expected. I'm trying to add additional parms/arguments in the saved search and pass the value from the code. It doesn't work. Which arguments do I need to use to pass the additional parameters?

Saved Search:

source="abc.log" index="index1" | search host=$temp$| stats count(host)

Java Code:

SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.setDispatchEarliestTime("1460590443"); 
dispatchArgs.setDispatchLatestTime("1460703600");
**dispatchArgs.put("temp", "host1");**    

Job jobSavedSearch = null;    
SavedSearch savedSearches1 = service.getSavedSearches().get("SavedSearchName");    
jobSavedSearch = savedSearches1.dispatch(dispatchArgs);

Error :

Exception in thread "main" com.splunk.HttpException: HTTP 400 -- 
 In handler 'savedsearch': Argument "temp" is not supported by this handler.

What arguments should I pass from the code?

Thanks

0 Karma

kirillchokparov
Explorer

It works if add "args." before argument name. For example the saved search (with the name "findSurname") is:

host=my_host field1=$args.surname$

then you can do:

    SavedSearch savedSearch = splunkService.getSavedSearches().get("findSurname"); //get your saved search by name

    SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
   dispatchArgs.add("args.surname", "IVAN*");

    Job job = savedSearch.dispatch(dispatchArgs);

    while(!job.isDone()){
        try {
            Thread.sleep(500);
        } catch (InterruptedException ex) {
            System.out.println("Waiting thread was interrupted: " + ex.toString());
        }
    }

    try{
        Args outputArgs = new Args();
        outputArgs.put("output_mode","json");

        InputStream inputStream = job.getEvents(outputArgs);
        byte[] buffer = new byte[4096];

        while(inputStream.read(buffer)!=-1){
            System.out.println(new String(buffer));
        }
    }catch(Exception ex){
        System.out.println("Error getting result from Splunk: " + ex.toString());
    }

Also you can see some examples about saved searches with Splunk SDK here: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...