This is a follow up question for the same requirement in this question: https://answers.splunk.com/answers/308933/is-it-not-possible-to-run-splunk-cli-savedsearch-w-1.html
I have a requirement where I am invoking a Splunk saved search from a shell script
splunk search '|savedsearch "Myreport". My savedsearch looks something like this:
index=ABC|mysearch| table a, b, c, d, e |dboutput database=XXX type=sql "INSERT INTO xyz (v,w,x,y,z) VALUES ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"
How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script?
$? is 0 even if the search fails or there is no data to extract. I have to schedule another saved search based on whether the above search was successful or not. If I use stderr, I need to add some more logic to grep for ERROR and INFO. Is there a simpler way of handling the exit status? Thanks in advance for the help!!
I would recommend using the rest api to create a search job with wget or curl. Then you can get the job status and results with a shell script. Other option is to use one of the SDKs.