How do I capture and verify the response (exit status) of this CLI savedsearch in the shell script?

[yelkey]

Hi,

This is a follow up question for the same requirement in this question: https://answers.splunk.com/answers/308933/is-it-not-possible-to-run-splunk-cli-savedsearch-w-1.html
I have a requirement where I am invoking a Splunk saved search from a shell script splunk search '|savedsearch "Myreport". My savedsearch looks something like this:

index=ABC|mysearch| table a, b, c, d, e 
  |dboutput database=XXX type=sql "INSERT INTO xyz 
                          (v,w,x,y,z) 
                          VALUES
                          ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? $? is 0 even if the search fails or there is no data to extract. I have to schedule another saved search based on whether the above search was successful or not. If I use stderr, I need to add some more logic to grep for ERROR and INFO. Is there a simpler way of handling the exit status? Thanks in advance for the help!!

[bmacias84 · Accepted solution]

I would recommend using the rest api to create a search job with wget or curl. Then you can get the job status and results with a shell script. Other option is to use one of the SDKs.

[somesoni2]

Agree and here is how it can be done.
http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTsearches

See section Create a search job

[yelkey]

Thank you. I'll take a look at the link.