I am trying to figure out how to execute a saved search and get the results using the REST API. I have created few saved searches, but I'm not able to list them when I try
curl -ks -u admin: https://splunkrest:8089/services/saved/searches. It just shows the default searches.
Any specific permission I need to set on the saved search so that they can be used via REST API?
I am able to view my saved search properties now. Thanks for your help. When I try to execute REST API call for dispatching the saved search, I get following error message, Any idea?
bash-3.2$ curl -ks -u : https://splunkrestsvc.fmrco.com/servicesNS/-/-/saved/searches/API_Test/dispatch -d force_dispatch=true <msg type="ERROR">
In handler 'savedsearch': Cannot edit/create a saved search for wildcarded users or applications
In handler 'savedsearch': Cannot edit/create a saved search for wildcarded users or applications is the error message.
The endpoint is actually this
Once you've the property using first curl, grab the owner/author and the app context and use that for your second dispatch curl.