Splunk Rest API call

[sibanandapani]

We need to have a rest service to our saved searches, where we can pass the start time and end time and the name of the search and it can trigger the the search. and it should send an email too..will this be possible?

[mhorbul]

The mentioned doc explains how to create/update/delete "saved search". But seems like that API does not allow to enable/disable action.email and enable/disable a schedule of that search. Am I missing something or I have to go to Web UI and check the checkboxes in order to enable/disable those options ?

[mhorbul]

I am not talking about rescheduling but about enabling "Schedule Alert" feature

http://goo.gl/n9OKfu

and also "Enable Email" checkbox inside

http://goo.gl/7dTI3x

[psanford_splunk]

For scheduling: Check out these links:

http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D....

http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D....

Check the scheduled_times attribute for a list of epoch times.

[psanford_splunk · Accepted solution]

Hi - Have you seen the saved search REST API docs? http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D....

We also have examples in our SDKs.

Java: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY#runsavedargs

C#: http://dev.splunk.com/view/csharp-sdk/SP-CAAAEQF#runsavedargs