Getting Data In

Syntax to update my scheduled search using REST?

the_wolverine
Champion

I'm trying to update the max_concurrent instances on my scheduled search from the default of 1 to 2. But the REST command doesn't appear to be working.

curl -k -u admin:changeme https://splunk:8089/servicesNS/admin/search/saved/searches/test_search -d 'max_concurrent=2' -d sharing=app

(Note: the url is correct)

Can someone spot the issue in my curl command?

0 Karma

somesoni2
Revered Legend

Try without the single quotes for max_concurrent as well.

curl -k -u admin:changeme https://splunk:8089/servicesNS/admin/search/saved/searches/test_search -d max_concurrent=2 -d sharing=app
0 Karma

the_wolverine
Champion
<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">
 In handler 'savedsearch': Argument "sharing" is not supported by this handler.</msg>
  </messages>
</response>
0 Karma

ben_leung
Builder

Is the argument not applicable when modifying a system configuration?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...