Getting Data In

How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

wmoy
New Member

I have a number of scheduled reports previously created via the WEB UI following a template similar to the ones shown below as the report name.

  • [Report-devicename1] app name denies
  • [Report-devicename1] app name allows
  • [Report-devicename2] app name denies
  • [Report-devicename2] app name>allows

I am able to get the sid for All the scheduled report with https:..../search/jobs --get output_mode=csv,
but how can I get the sid for just a particular report for example, "[Report-devicename2] app name denies" with the rest api is where I'm having trouble.

Thanks in advance.

0 Karma
1 Solution

DavidHourani
Super Champion
0 Karma

wmoy
New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma

DavidHourani
Super Champion
0 Karma

wmoy
New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma

DavidHourani
Super Champion

Did you try going to the REST endpoint URL directly in your browser ? Is that what u mean by tried via the Web UI ?
Start from there, if you can see the data then making the |REST command should br easy. Let me know if you got nothing and I'll link u the rest command.

0 Karma

wmoy
New Member

David,

The "|REST" command was the clue that help me figured out the correct api syntax.

Thanks for your help !.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...