Getting Data In

How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

wmoy
New Member

I have a number of scheduled reports previously created via the WEB UI following a template similar to the ones shown below as the report name.

  • [Report-devicename1] app name denies
  • [Report-devicename1] app name allows
  • [Report-devicename2] app name denies
  • [Report-devicename2] app name>allows

I am able to get the sid for All the scheduled report with https:..../search/jobs --get output_mode=csv,
but how can I get the sid for just a particular report for example, "[Report-devicename2] app name denies" with the rest api is where I'm having trouble.

Thanks in advance.

0 Karma
1 Solution

DavidHourani
Super Champion
0 Karma

wmoy
New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma

DavidHourani
Super Champion
0 Karma

wmoy
New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma

DavidHourani
Super Champion

Did you try going to the REST endpoint URL directly in your browser ? Is that what u mean by tried via the Web UI ?
Start from there, if you can see the data then making the |REST command should br easy. Let me know if you got nothing and I'll link u the rest command.

0 Karma

wmoy
New Member

David,

The "|REST" command was the clue that help me figured out the correct api syntax.

Thanks for your help !.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...