How to Edit saved search using Splunk REST ?

sagrl · ‎10-01-2016

I want to edit the search of a Saved Search Report using REST in Python without any other change. But when i am using the below code,it is creating a new saved search with private permission. Please help me in changing the search of the saved report with the existing permission.

 myhttp.request(baseurl + '/servicesNS/sys-splunk/AS/saved/searches/15_report','POST', headers={'Authorization': 'Splunk %s' % sessionkey},body=urllib.urlencode({'search': "index=*"}))

polymorphic · ‎10-04-2016

This should work:
curl -k -u user:password https://qualifiedurl:8089/servicesNS/nobody/search/saved/searches/test/ -d "search=index=*"

How to Edit saved search using Splunk REST ?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

SplunkTrust Application Period is Officially OPEN!

Join the Conversation

How to Edit saved search using Splunk REST ?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

SplunkTrust Application Period is Officially OPEN!