Getting Data In

How to rename the savedsearches using REST API

Hi Splunkers,

Any idea how can we rename the saved searches using REST API.

I have tried by referring https://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API but I'm getting errors while executing.Please assist me .Thanks!

0 Karma

Super Champion

You need to do outside Splunk GUI as GUI supports REST GET only.

So your client (postman) or curl.
An example using CURL with MySavedSearch which has ownership of admin user

curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch -d title="MyNewSearch"

Please refer https://docs.splunk.com/Documentation/Splunk/7.2.6/RESTREF/RESTsearch

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!