Getting Data In

Can i use rest API to see the latest result of a saved search?

kairobin
Path Finder

In the web Interface of Splunk - Saved Searches. One can view the latest result of a saved search.
This wil give the user the information without doing the search over again.

Does anybody have a way or an example on how to to get these result out using PHP, Curl og even Powershell?

Thanks in advance.
kai

Tags (2)
0 Karma
1 Solution

acharlieh
Influencer

With the REST API you could use /saved/searches/{name}/history to get all jobs, which will then return links to /search/jobs/{search_id} which is links or a minor url modification away from /search/jobs/{search_id}/results

There are examples all through the RESTREF doc that should help you out.

View solution in original post

kairobin
Path Finder

This wil give me much more to work With.
thank you

0 Karma

acharlieh
Influencer

With the REST API you could use /saved/searches/{name}/history to get all jobs, which will then return links to /search/jobs/{search_id} which is links or a minor url modification away from /search/jobs/{search_id}/results

There are examples all through the RESTREF doc that should help you out.

kairobin
Path Finder

Do you have an examle of this script?
I thought that this only worked with a live search. That for instanc $5 only has information when it ran a search.

0 Karma

harsmarvania57
Ultra Champion

This script will run when your schedule search will run.

0 Karma

harsmarvania57
Ultra Champion

Hi,

I am not sure about rest API, but you can create a script and you can use Splunk arguments to fectch the results, results will be in .tar.gz format, so you have to extract result with your script.

Ref. for splunk argument: http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Configuringscriptedalerts#Access_arguments_t...

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...