Getting Data In

Can we change the cron schedule of a saved search through REST call?

pradeepkumarg
Influencer

I've tried something like below with no luck.

curl -k -u admin:thepassword https://splunk_server:8089/servicesNS/admin/launcher/saved/searches/test_search/acl -d cron_schedule=/"*5 * * * *" -d sharing=app
0 Karma
1 Solution

jplumsdaine22
Influencer

Your URI should be something like:

/servicesNS/admin/search/saved/searches/test_search -d 'cron_schedule=5 *' -d 'sharing=app'

See http://docs.splunk.com/Documentation/Splunk/6.3.1511/RESTREF/RESTsearch#POST_saved.2Fsearches_method...

Also, make sure you use curl -v when you're testing - the HTTP response code and the response body should tell you what you're doing wrong (eg if the url is wrong, or a parameter was incorrect). If you post that information into your question here as well it will help people out.

View solution in original post

jplumsdaine22
Influencer

Your URI should be something like:

/servicesNS/admin/search/saved/searches/test_search -d 'cron_schedule=5 *' -d 'sharing=app'

See http://docs.splunk.com/Documentation/Splunk/6.3.1511/RESTREF/RESTsearch#POST_saved.2Fsearches_method...

Also, make sure you use curl -v when you're testing - the HTTP response code and the response body should tell you what you're doing wrong (eg if the url is wrong, or a parameter was incorrect). If you post that information into your question here as well it will help people out.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...