Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to query against Splunk API a saved search wit...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to query against Splunk API a saved search without the search Id?
Can someone suggest how to query against Splunk API for a saved search without the Search Id? Basically we have a requirement to make a call against Splunk API (REST) for a saved search and get results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You did not describe what your IDE or language are but Splunk SDK dox are here:
http://dev.splunk.com/view/sdks/SP-CAAADP7
If you want to do it via the REST API - then take a look at these two tutorials:
http://dev.splunk.com/view/SP-CAAADQ5
http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK
REST API reference docs for saved searches are here: http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2...
You call dispatch for the search you care about and then you should be off and running.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can first list all your saved Searches like this
| rest services/search/jobs | search isSavedSearch=1 | stats count by label
then you can specifically interrogate them if needed
| rest services/search/jobs | search label="my special saved search"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a saved search and wanted to invoke the saved search via rest api and get results from the api.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you OK now?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So you want to run the saved search or want to get information about the saved search (and what information if yes)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What he asked.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
