How to enable and disable scheduled searches using Splunk REST API in Powershell?

[vivekriyer]

I have a requirement to disable scheduled search (specific ones) during a specific window and when a data load runs, enable it back on once the load is completed.
I have a limitation of running it Powershell. I went through couple of Answers posts and was not able to find a post related to Powershell implementation.

Thanks in advance.

[acharlieh · Accepted solution]

I am not a powershell user... however it looks like there's a cmdlet to Invoke a HTTP Rest service, namely Invoke-RestMethod: https://technet.microsoft.com/en-us/library/hh849971.aspx

In fact the documentation on that page has an example of performing a POST request that's using the Splunk API to execute a Splunk search and getting results from it.

Armed with this, and the Splunk REST reference, it should be only minor modifications to the $Url and $Body arguments to then be able to modify your saved search (to schedule / unschedule it at whim): http://docs.splunk.com/Documentation/Splunk/6.4.3/RESTREF/RESTsearch#POST_saved.2Fsearches.2F.7Bname...