Getting Data In

How do you create saved search using REST API call?

sp04355
New Member

Works in curl:

curl -k -u admin:changeme http://localhost:8089/servicesNS/admin/search/saved/searches -d name=MySavedSearch --data-urlencode search="index=_internal source=*metrics.log"

The same call from Postman:

http://localhost:8089//servicesNS/admin/launcher/saved/searches?name="MySavedSearch"&search="index=_... source=*metrics.log"

< ERROR">Cannot perform action "POST" without a target name to act on.

What is the target name it complains about? I provided an application name as a target — not good enough?

0 Karma

paulstark2
Engager
curl -k -u admin:changeme https://localhost:8089/services/saved/searches \
	-d name=firstApiTest \
	-d disabled=1 \
	-d owner=nobody \
	-d description=descritionText \
	-d search="index=main" \
	-d dispatch.index_earliest=-7d \
	-d dispatch.index_latestlatest=now
0 Karma

damode1
Path Finder

Is there a way to pass these values from a file?

	-d name=firstApiTest \
	-d disabled=1 \
	-d owner=nobody \
	-d description=descritionText \
	-d search="index=main" \
	-d dispatch.index_earliest=-7d \
	-d dispatch.index_latestlatest=now
0 Karma

whrg
Motivator

Hello @sp04355,

Do you know the distinction between GET and POST requests? If not, you should probably google it. One important difference is that GET parameters are sent as part of the URL whereas POST parameters are sent in the request body after the HTTP headers.

When you browse the REST API Reference Manual then you will see that there are many functions which depend on the type of the request (GET, POST, DELETE...). GET is usually for requesting data whereas POST is for making changes.

Your curl command above will run a POST request which looks like this:

POST /servicesNS/admin/search/saved/searches HTTP/1.1
Authorization: Basic ...
User-Agent: curl/...
Host: localhost
Accept: */*
Content-Length: 66
Content-Type: application/x-www-form-urlencoded

name=MySavedSearch&search=index%3D_internal%20source%3Dmetrics.log

Now I'm not familiar with Postman but from what I can see: You are explicitly putting the parameters in the URL instead of the request body. So you are sending a POST request without any valid parameters. That's why Splunk is complaining that it cannot find the "name=MySavedSearch" parameter.

So I advice to check the Postman documentation on how to send a POST request.

Side note 1: Why do you have "launcher" in the postman URL?
Side note 2: I'm surprised to see that you are using http instead of https.

0 Karma

sp04355
New Member

Should i add a stanza to the input.conf?
I have the same issue on create index as well.
Please, Splunk gurus? Anybody knows the answer?

0 Karma

gerrysr6
Explorer

what the heck is a stanza?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...