How would I get report ID or ID for the saved/schedule search?

[SplunkDash]

Hello,

How would I get report ID or ID for the saved/schedule search? Thank you!

[ITWhisperer]

Saved searches ids are in the following format:

owner:app:title

You can load the results with 

| loadjob savedsearch="owner:app:title"

[isoutamo]

If/when you are running this on SHC, you should remember this:

A search head cluster can run the loadjob command only on scheduled saved searches. A search head cluster runs searches on results or artifacts that the search head cluster replicates.

r. Ismo

[SplunkDash]

Hello,

Thank you so much for your quick response, truly appreciate it.

The main objective here is to export this report result to third party server using API. My plan is to pull the report results and store it in one of our servers using API and send that result from there to third party server using another API call. Do you have any recommendations how I can proceed or can make API call to get/pull that report  to our server?

[isoutamo]

Probably calling this search via REST API is the easiest way to get report from splunk to your another server/service. You could read from here how it can do.

Based on your security requirements, it's best to create a separate service user just for this with as restricted access right as possible.

[SplunkDash]

Hello @isoutamo,

Thank you so much again:

if this is the link I need use

https://<host>:<mPort>/services/search/jobs/{search_id}

 What is the {search_id} , and how I can get that?

[isoutamo · Accepted solution]

Here is some old answers and other examples/instructions how to use it

• https://community.splunk.com/t5/Getting-Data-In/REST-API-endpoints-for-saved-searches/m-p/355507
• https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches
• https://community.splunk.com/t5/Splunk-Search/How-to-execute-a-saved-search-using-Splunk-s-REST-API/...
• https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtowork/#To...
• https://community.splunk.com/t5/Reporting/How-to-start-a-saved-search-using-REST-API/m-p/88026
• https://hurricanelabs.com/splunk-tutorials/splunk-searching-with-rest-api/
• https://stackoverflow.com/questions/70541196/http-get-method-for-splunk-saved-search-using-access-to...