Triggering searches

[SplnkUse]

Hello,

I am still trying to figure out the framework of how things work (please note I am not admin).

There is a dashboard which has some radio buttons which trigger specific searches and the results are displayed in the dashboard.

I want to trigger these searches ad hoc in the Search webpage. So I need to:

1. Get a search alias/link/id for each of the searches in the dashboard
2. Use these aliases to trigger the same search manually

I would prefer to use a REST API command directly in my PowerBI, is that possible?

If not, I would still prefer to use a REST API command in the Search webpage

Unfortunately, the following does not work for me:

| rest /services/data/ui/views/

But this works:

| rest splunk_server=local servicesNS/-/-/data/ui/views/

Can you help me with the right code please?

Thanks!

[richgalloway · Accepted solution]

Not all dashboards have links to their searches (IME, most do not).  Instead, the searches are inline.

To replicate a dashboard using the API, you'd have to use the data/ui/views call to get the eai:data field.  Then you'll need to parse that field to extract the <input> elements (so you know what the inputs are) and the <panel> elements.  Each will contain a <search>, which may be an in-line search or may invoke a savedsearch using either the loadjob or savedsearch command.

The <input> elements will define one or more tokens.  Any search that uses a token will not run until that token is defined.  This is the "trigger" you've noticed.  Your code will have to get the proper input from the user so it can set the tokens needed by the searches.

Once the tokens are defined, you can fill in the missing parts of the searches and use the REST API to invoke them.  The API will return a search ID, which you will use to periodically poll Splunk to see if the search has completed or not.  Once the search is complete, you can use another API call to retrieve the results.