Getting Data In

How do you create saved search using REST API call?

sp04355
New Member

Works in curl:

curl -k -u admin:changeme http://localhost:8089/servicesNS/admin/search/saved/searches -d name=MySavedSearch --data-urlencode search="index=_internal source=*metrics.log"

The same call from Postman:

http://localhost:8089//servicesNS/admin/launcher/saved/searches?name="MySavedSearch"&search="index=_... source=*metrics.log"

< ERROR">Cannot perform action "POST" without a target name to act on.

What is the target name it complains about? I provided an application name as a target — not good enough?

0 Karma

paulstark2
Engager
curl -k -u admin:changeme https://localhost:8089/services/saved/searches \
	-d name=firstApiTest \
	-d disabled=1 \
	-d owner=nobody \
	-d description=descritionText \
	-d search="index=main" \
	-d dispatch.index_earliest=-7d \
	-d dispatch.index_latestlatest=now
0 Karma

damode1
Path Finder

Is there a way to pass these values from a file?

	-d name=firstApiTest \
	-d disabled=1 \
	-d owner=nobody \
	-d description=descritionText \
	-d search="index=main" \
	-d dispatch.index_earliest=-7d \
	-d dispatch.index_latestlatest=now
0 Karma

whrg
Motivator

Hello @sp04355,

Do you know the distinction between GET and POST requests? If not, you should probably google it. One important difference is that GET parameters are sent as part of the URL whereas POST parameters are sent in the request body after the HTTP headers.

When you browse the REST API Reference Manual then you will see that there are many functions which depend on the type of the request (GET, POST, DELETE...). GET is usually for requesting data whereas POST is for making changes.

Your curl command above will run a POST request which looks like this:

POST /servicesNS/admin/search/saved/searches HTTP/1.1
Authorization: Basic ...
User-Agent: curl/...
Host: localhost
Accept: */*
Content-Length: 66
Content-Type: application/x-www-form-urlencoded

name=MySavedSearch&search=index%3D_internal%20source%3Dmetrics.log

Now I'm not familiar with Postman but from what I can see: You are explicitly putting the parameters in the URL instead of the request body. So you are sending a POST request without any valid parameters. That's why Splunk is complaining that it cannot find the "name=MySavedSearch" parameter.

So I advice to check the Postman documentation on how to send a POST request.

Side note 1: Why do you have "launcher" in the postman URL?
Side note 2: I'm surprised to see that you are using http instead of https.

0 Karma

sp04355
New Member

Should i add a stanza to the input.conf?
I have the same issue on create index as well.
Please, Splunk gurus? Anybody knows the answer?

0 Karma

gerrysr6
Explorer

what the heck is a stanza?

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...