Why am I unable to run savedsearches from RESTAPI?

[GersonGarcia]

All, I created simple savedsearch as followed:

 | makeresults | eval msg="test for Jason"

And save it as "ggarcia_test_jason"

But when I try to run it from command line using RESTAPI I am getting the following error:

ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:********' "https://splunk.ssnsgs.net:8089/servicesNS/admin/search/search/jobs/export" -d search=" savedsearch ggarcia_test_jason"
<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="FATAL">Error in 'savedsearch' command: Unable to find saved search named 'ggarcia_test_jason'.</msg>
  </messages>
</response>

I can run the search directly:

ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:********' "https://splunk.ssnsgs.net:8089/servicesNS/admin/search/search/jobs/export" -d search=" | makeresults | eval msg=\"test for Jason\"" -d output_mode=json
{"preview":false,"offset":0,"lastrow":true,"result":{"_time":"2018-04-24 16:21:39.000 GMT","msg":"test for Jason"}}

I have no idea what I am doing wrong.

Can anybody help me?

Thank you

[logloganathan]

could you please share the splunk query that you tried in RestAPI?

[damien_chillet]

You specified search app context in your API endpoint, are you sure the search is visible in that context?

[GersonGarcia]

Damien,

That is a good question... I tried to list all Saved Searches and the one I am trying is not there:

ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:*******' "https://splunk.ssnsgs.net:8089/servicesNS/-/-/saved/searches" | grep '<title>'
  <title>savedsearch</title>
    <title>Bucket Copy Trigger</title>
    <title>DMC Alert - Abnormal State of Indexer Processor</title>
    <title>DMC Alert - Critical System Physical Memory Usage</title>
    <title>DMC Alert - Expired and Soon To Expire Licenses</title>
    <title>DMC Alert - Missing forwarders</title>
    <title>DMC Alert - Near Critical Disk Usage</title>
    <title>DMC Alert - Saturated Event-Processing Queues</title>
    <title>DMC Alert - Search Peer Not Responding</title>
    <title>DMC Alert - Total License Usage Near Daily Quota</title>
    <title>DMC Asset - Build Full</title>
    <title>DMC Asset - Build Standalone Asset Table</title>
    <title>DMC Asset - Build Standalone Computed Groups Only</title>
    <title>DMC Forwarder - Build Asset Table</title>
    <title>DMC License Usage Data Cube</title>
    <title>Errors in the last 24 hours</title>
    <title>Errors in the last hour</title>
    <title>Indexing workload</title>
    <title>instrumentation.lastSent</title>
    <title>instrumentation.licenseUsage</title>
    <title>instrumentation.reportingErrors</title>
    <title>License Usage Data Cube</title>
    <title>Messages by minute last 3 hours</title>
    <title>Orphaned scheduled searches</title>
    <title>Splunk errors last 24 hours</title>
    <title>Top five sourcetypes</title>

Maybe because it is SH Cluster?

Thank you,

[damien_chillet]

Does the search you are trying to run have private permissions?

[GersonGarcia]

No, it does not.

[GersonGarcia]

This is interesting...

If I look for the saved search against my load balance I don't get the result, but if I tried directly to one of the SH it works...

ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:********' "https://s<load_balance>:8089/servicesNS/-/ssn/saved/searches/ggarcia_test_jason" | grep '<title>'
ggarcia-osx:~ ggarcia$ curl -ks -u 'ggarcia:********' "https://<hostname>:8089/servicesNS/-/ssn/saved/searches/ggarcia_test_jason" | grep '<title>'
  <title>savedsearch</title>
    <title>ggarcia_test_jason</title>

It worked now... Thank you...

ggarcia-osx:~ ggarcia$ curl -k -u 'ggarcia:*******' "https://<hostname>:8089/servicesNS/admin/ssn/search/jobs/export" -d search=" savedsearch ggarcia_test_jason"
<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>_time</field>
<field>msg</field>
</fieldOrder>
</meta>
<messages>
  <msg type="DEBUG">Configuration initialization for /usr/ssn/splunk/etc took 277ms when dispatching a search (search ID: 1524759462.1375367_512742A3-6B36-4E10-8BD6-D073A8FD06D5)</msg>
  <msg type="DEBUG">search context: user="ggarcia", app="ssn", bs-pathname="/usr/ssn/splunk/etc"</msg>
</messages>

    <result offset='0'>
        <field k='_time'>
            <value><text>2018-04-26 09:17:42.000 PDT</text></value>
        </field>
        <field k='msg'>
            <value><text>test for Jason</text></value>
        </field>
    </result>
</results>

[damien_chillet]

Strange, the saved search should have been replicated across the cluster - unless your created it by editing manually savedsearches.conf on one of the search head?