Getting Data In

How to Edit saved search using Splunk REST ?

sagrl
Explorer

I want to edit the search of a Saved Search Report using REST in Python without any other change. But when i am using the below code,it is creating a new saved search with private permission. Please help me in changing the search of the saved report with the existing permission.

 myhttp.request(baseurl + '/servicesNS/sys-splunk/AS/saved/searches/15_report','POST', headers={'Authorization': 'Splunk %s' % sessionkey},body=urllib.urlencode({'search': "index=*"}))
Tags (2)
0 Karma

polymorphic
Communicator

This should work:
curl -k -u user:password https://qualifiedurl:8089/servicesNS/nobody/search/saved/searches/test/ -d "search=index=*"

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...