I'm trying to update the max_concurrent instances on my scheduled search from the default of 1 to 2. But the REST command doesn't appear to be working.
curl -k -u admin:changeme https://splunk:8089/servicesNS/admin/search/saved/searches/test_search -d 'max_concurrent=2' -d sharing=app
(Note: the url is correct)
Can someone spot the issue in my curl command?
Try without the single quotes for max_concurrent as well.
curl -k -u admin:changeme https://splunk:8089/servicesNS/admin/search/saved/searches/test_search -d max_concurrent=2 -d sharing=app
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">
In handler 'savedsearch': Argument "sharing" is not supported by this handler.</msg>
</messages>
</response>
Is the argument not applicable when modifying a system configuration?