How to disable scheduled searches via command line interface?

[pfernandez133]

Hey guys, I'm looking for a way to disable multiple scheduled searches via command line.

Once a week, we switch one environment on and the other off, so we want to disable searches/alerts for the environment we've disabled. As you may have guessed, it's quite a few searches/alerts that need to be disabled. A command-line method would allow me to script it.

Thanks in advance!

[pretzel2]

Help vote up these new feature ideas ..   which is for Splunk to create an app or feature within to product to schedule reoccurring disablement of certain scheduled searches/alerts/reports.

https://ideas.splunk.com/ideas/EID-I-181

https://ideas.splunk.com/ideas/EID-I-654

[lmyrefelt]

You can also disabled "scheduling capability" in $SPLUNK_HOME/etc/system/{local,default}/default-mode.conf
No scheduled searches willl run ... "ever" on this server.

[pipeline:scheduler]
disabled = true

[Ledion_Bitincka]

you can use the REST endpoint directly either through curl or by programming against it using the SDKs to

curl -ku admin:changeme https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

 eg 

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"

[jkat54]

Let's get out of the habit of adding a password to our curls, which would then end up in os logs.

curl -ku admin https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

curl -ku admin https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"

The above will prompt you for password and not reveal it to the world of shoulder surfers and history buffs.

[pfernandez133]

Thanks for the suggestion!

I had to set "is_scheduled=true" to get it to flip from 0 to 1, but the search's status is still set to disabled under Manager > Searches and Reports. How can I switch that disabled to enabled?

Thx again!

[jrodman]

To be clear, this disables the scheduling aspect, or alert, of the search, instead of disabling the whole search. I think it's the best option for your goal though.

[Ledion_Bitincka]

You should be able to do that by:

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar/enable -d ""

Learn more about our REST API