Does anyone know how to convert a savedsearch request to a REST API endpoint request?

[kmugglet]

Does anyone know how to convert this savedsearch request to a REST endpoint request?

|savedsearch mysearch replace_me="value"

I can run a normal savedsearch "apm_cvc_qtr_bh_test" using curl in the app apm_snpm

curl -k -u svc_user_bob:password https://localhost:8089/servicesNS/svc_user_bob/apm_snpm/saved/searches/apm_cvc_qtr_bh_test/dispatch -d trigger_actions=1

but i don't know how to pass the replace_me key and value

Any ideas?

[kmugglet · Accepted solution]

For the rest call

curl -k u user:password https://blah.local:8089/servicesNS/svc_usr_bob/apm_snpm/saved/searches/apm_cvc_qtr_bh_test/dispatch -d trigger_actions=1 -d args.startDate="-3d" -d args.endDate="-0d"

in the saved search

eventtype=service-CombinedForwardingPlaneQueueGroupServiceIngressLogRecord earliest=$args.startDate$ latest=$args.endDate$

I should work for the NSA after decrypting the Splunk doco

[somesoni2]

See this example

http://answers.splunk.com/answers/8945/how-to-start-a-saved-search-using-rest-api.html

you can just give your "|savedsearch" command as search query in curl.

[kmugglet]

Thanks, but I couldn't see in there how to pass the values for a template search...