How to automatically update scheduled saved search from dashboard

[bowesmana]

I have a number of saved searches scheduled to run each morning. However, I have a dashboard that allows certain configuration items to be changed in the app, which then would require those saved searched to run as the previous results are now invalid.

I am using

| savedsearch xxx

in my dashboard, but that only runs the saved search, it does not update the previously cached result set. I cannot find a way for me to force a 'scheduled' run of those searches so the results are then saved for the next 24 hours.

In the past, I have manually updated the scheduled time to be a few minutes in the future, wait for the searches to run, and then set the schedule times back to their original time, but with about 10 saved searches, and the app deployed on a client site, that's not practical.

Any idea how to do this?

[bowesmana · Accepted solution]

The solution is to use the curl app from Splunkbase and to issue the REST API reschedule command for the relevant SS from within SPL in the dashboard, so I am doing something like

| rest /servicesNS/nobody/myapp/saved/searches
| where title like "my_app_ss_%" 
| fields title 
| map maxsearches=100 search="
| curl method=post uri="https://localhost:8089/servicesNS/nobody/myapp/saved/searches/$$title$$/reschedule" datafield="schedule_time=+1m" splunkauth=true
| table *
"
| rex field=curl_response_url ".*/(?<title>[^/]*)/reschedule"
| eval Status=case(curl_status=200,"OK",curl_status=400,"Bad Request",curl_status=401,"Unauthorized",curl_status=403,"Forbidden",true(),"HTTP Status ".curl_status)
| table title, Status

and this gives me a table of whether the entry was rescheduled. The searches will then run at some point based on their window settings and then go back to their original next scheduled time.

Obviously it does require that the user has permissions to run REST calls and modify the SS schedule time, but that's fine in my case.

Note that the REST API is used first to read the list of SS, but in order to do the POST, it requires curl, as | rest does not support the POST API endpoints.

[nareshinsvu]

savedsearch is just a set of SPL code for easy use in the dashboards.

Did you hardcode anything in your saved search referred by your dashboard? If so, try to fix that?

[jacobpevans]

Could you please explain what your requirement is? Why do you want to do this? Might there be any alternative solutions? I'm not saying it's not possible, just provide more info.

[bowesmana]

My requirement is for a user to trigger an update of data in a KV store, from which then dependent saved searches are run to update stats from that updated KV store. Normally the KV store is updated once a day and the saved searches run after that update, but it is possible for a user to cause a change in the KV store, rendering the existing saved search results obsolete, and in fact now incorrect on dashboards that use those searches.