Can we change the cron schedule of a saved search through REST call?

[pradeepkumarg]

I've tried something like below with no luck.

curl -k -u admin:thepassword https://splunk_server:8089/servicesNS/admin/launcher/saved/searches/test_search/acl -d cron_schedule=/"*5 * * * *" -d sharing=app

[jplumsdaine22 · Accepted solution]

Your URI should be something like:

/servicesNS/admin/search/saved/searches/test_search -d 'cron_schedule=5 *' -d 'sharing=app'

See http://docs.splunk.com/Documentation/Splunk/6.3.1511/RESTREF/RESTsearch#POST_saved.2Fsearches_method...

Also, make sure you use curl -v when you're testing - the HTTP response code and the response body should tell you what you're doing wrong (eg if the url is wrong, or a parameter was incorrect). If you post that information into your question here as well it will help people out.