Developing for Splunk Enterprise

REST API call to run a saved search with macro replacement?

Lowell
Super Champion

Is there a way to directly launch a saved search via the scheduler while passing key/value pairs for macro replacement via an API call?

The only place I've seen any reference to macro replacements for saved search is with the savedsearch search command documentation, and it's fairly brief. So I haven't seen anything that talks about how to do this, but that's not too surprising.

Just for the reccord, (because I'm sure someone will point it out)... Simply running a search of "| savedsearch mysavedsearch key=value" is not an option in my particular use case. I need any triggered actions associated with the saved search to be run, and the only way I know of doing that is via the scheduler. So I believe that rules out the possibility of using the savedsearch search command.

My ultimate goal is to do this from Splunk's python API. I can launch a saved search with the scheduler like so, the only piece I'm missing is how to pass in values for macro expansion. Any ideas?

import splunk.saved
job = splunk.saved.dispatchSavedSearch("mysavedsearch", sessionKey=sessionKey, namespace="myapp", owner="owner", triggerActions="1", now=timestamp)

Related stuff:

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no facility for setting the saved search replacement parameters via the API.

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, there is no facility for setting the saved search replacement parameters via the API.

View solution in original post

0 Karma