Examples of using variable in REST API search? Is it possible?

[the_wolverine]

Are there any examples of how to pass a variable to query when using REST API?

[the_wolverine · Accepted solution]

Here's an example of running a saved search and passing a variable to it. In this case, the variable is host field:

$curl -k -u admin:password https://splunkserver:8089/services/search/jobs/export -d search="savedsearch \ MySavedSearch%20host%3Dwolverine*"

(use "MySavedSearch" and input variable host=wolverine* )

I have a saved search named "MySavedSearch" the query of the search contains:

"index=main $host$ | head 100"

I wish there were more examples like this in the documentation so I am providing it here in hopes that it can help someone else.

[the_wolverine]

For example, I want to create a search that accepts a variable input (e.g. IP address) so I can reuse it. After thinking more about this, looks like I can pre-populate Splunk with saved searches that accept such a variable but it would be nice to see cool examples of how other customers have done this.

[dart]

Can you expand upon your use case? I'm not clear on what you mean by a variable.