Getting Data In
Highlighted

How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

New Member

I have a number of scheduled reports previously created via the WEB UI following a template similar to the ones shown below as the report name.

  • [Report-devicename1] app name denies
  • [Report-devicename1] app name allows
  • [Report-devicename2] app name denies
  • [Report-devicename2] app name>allows

I am able to get the sid for All the scheduled report with https:..../search/jobs --get output_mode=csv,
but how can I get the sid for just a particular report for example, "[Report-devicename2] app name denies" with the rest api is where I'm having trouble.

Thanks in advance.

0 Karma
Highlighted

Re: How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma
Highlighted

Re: How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

SplunkTrust
SplunkTrust

Did you try going to the REST endpoint URL directly in your browser ? Is that what u mean by tried via the Web UI ?
Start from there, if you can see the data then making the |REST command should br easy. Let me know if you got nothing and I'll link u the rest command.

0 Karma
Highlighted

Re: How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

New Member

David,

The "|REST" command was the clue that help me figured out the correct api syntax.

Thanks for your help !.

0 Karma
Highlighted

Re: How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma