Dashboards & Visualizations

JavaScript To create a saved search

qfjp
Explorer

// Retrieve the collection of saved searches

var mySavedSearches = service.savedSearches();

// Specify a name and search query

var searchName = "Test Search";

// Note: Do not include the 'search' keyword for a saved search

var searchQuery = "* | head 10";

// Create the saved search

mySavedSearches.create({
name: searchName,
search: searchQuery
}, function(err, newSearch) {
console.log("A new saved search was created");
});

Do not know is that in the above function.
How do I set time and schedule?

jameshgibson
Path Finder

You need to set a few more options, here is an example that would schedule the job to run every 10mins over the previous month.

opts = { name: "searchname", 
         search: "* | head 10", 
         is_scheduled: 1, 
         cron_schedule: "*/10 * * * *",
         'dispatch.earliest_time': '-1mon@d',
         'dispatch.latest_time': 'now',
};


mySavedSearches.create(opts, function(err, newSearch) {
    console.log("created!");
}); 
0 Karma

jameshgibson
Path Finder

your welcome, please feel free to vote the answer up or accept 😉

0 Karma

qfjp
Explorer

Thanks!! Were very helpful.

0 Karma

linu1988
Champion

Please refer this documentation for the Savedsearch parameters:

_http://dev.splunk.com/view/SP-CAAAEKZ

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...