How to Edit saved search using Splunk REST ?

sagrl · ‎10-01-2016

I want to edit the search of a Saved Search Report using REST in Python without any other change. But when i am using the below code,it is creating a new saved search with private permission. Please help me in changing the search of the saved report with the existing permission.

 myhttp.request(baseurl + '/servicesNS/sys-splunk/AS/saved/searches/15_report','POST', headers={'Authorization': 'Splunk %s' % sessionkey},body=urllib.urlencode({'search': "index=*"}))

polymorphic · ‎10-04-2016

This should work:
curl -k -u user:password https://qualifiedurl:8089/servicesNS/nobody/search/saved/searches/test/ -d "search=index=*"

How to Edit saved search using Splunk REST ?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

How to Edit saved search using Splunk REST ?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future