Saved Search REST End Point

[lpolo]

The following URI returns the metadata information related to a saved search named "test" found in application "search":

https://myhost:8089/servicesNS/userid/search/saved/searches/test

I would like to know what will be the URI to run the saved search "test" found in application "search" where the returned data format is in json.

Thanks,
Lp

[lpolo]

I had to simplify the saved search to make it work. why? I do not know. the original saved search works when I dispatch the saved search and grab the results with the sid.

This is an example:
https://myhost.com:8089/services/search/jobs -d search=" savedsearch test" -d exec_mode=oneshot -d output_mode=json . It worked.

[lpolo]

I am aware of it. I just wanted know if it is possible to get the results of a saved search with a single REST call.

[gkanapathy]

That is what you would normally do with any search, even just a hardcoded search string, though I suppose you could run those with exec_mode of blocking or oneshot. If that's what you want to do, you can just get the search string for the saved search and dispatch a job using that string in the desired exec_mode.

[gkanapathy]

If you want to run a search, you must also specify the view in which it is run, assuming you want to link to it and run it in the UI. ( If you want to just schedule and run in the background without UI, you can use the REST call http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D.... )

Generally, this URL looks like http://splunkweb:8000/en-US/app/search/flashtimeline?s=test

[lpolo]

It looks like the only way is to dispatch the saved search and then grab the results.
It seems that there is not a way to call the saved search directly, unless; you call the end point to be part of a view like you mentioned.