Getting Data In

Can we change the cron schedule of a saved search through REST call?

Influencer

I've tried something like below with no luck.

curl -k -u admin:thepassword https://splunk_server:8089/servicesNS/admin/launcher/saved/searches/test_search/acl -d cron_schedule=/"*5 * * * *" -d sharing=app
0 Karma
1 Solution

Influencer

Your URI should be something like:

/servicesNS/admin/search/saved/searches/test_search -d 'cron_schedule=5 *' -d 'sharing=app'

See http://docs.splunk.com/Documentation/Splunk/6.3.1511/RESTREF/RESTsearch#POST_saved.2Fsearches_method...

Also, make sure you use curl -v when you're testing - the HTTP response code and the response body should tell you what you're doing wrong (eg if the url is wrong, or a parameter was incorrect). If you post that information into your question here as well it will help people out.

View solution in original post

Influencer

Your URI should be something like:

/servicesNS/admin/search/saved/searches/test_search -d 'cron_schedule=5 *' -d 'sharing=app'

See http://docs.splunk.com/Documentation/Splunk/6.3.1511/RESTREF/RESTsearch#POST_saved.2Fsearches_method...

Also, make sure you use curl -v when you're testing - the HTTP response code and the response body should tell you what you're doing wrong (eg if the url is wrong, or a parameter was incorrect). If you post that information into your question here as well it will help people out.

View solution in original post