Reporting
Highlighted

How to disable scheduled searches via command line interface?

Explorer

Hey guys, I'm looking for a way to disable multiple scheduled searches via command line.

Once a week, we switch one environment on and the other off, so we want to disable searches/alerts for the environment we've disabled. As you may have guessed, it's quite a few searches/alerts that need to be disabled. A command-line method would allow me to script it.

Thanks in advance!

0 Karma
Highlighted

Re: How to disable scheduled searches via command line interface?

Splunk Employee
Splunk Employee

you can use the REST endpoint directly either through curl or by programming against it using the SDKs to

curl -ku admin:changeme https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

 eg 

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"
Highlighted

Re: How to disable scheduled searches via command line interface?

Explorer

Thanks for the suggestion!

I had to set "is_scheduled=true" to get it to flip from 0 to 1, but the search's status is still set to disabled under Manager > Searches and Reports. How can I switch that disabled to enabled?

Thx again!

0 Karma
Highlighted

Re: How to disable scheduled searches via command line interface?

Splunk Employee
Splunk Employee

You should be able to do that by:

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar/enable -d ""

Learn more about our REST API

Highlighted

Re: How to disable scheduled searches via command line interface?

Splunk Employee
Splunk Employee

To be clear, this disables the scheduling aspect, or alert, of the search, instead of disabling the whole search. I think it's the best option for your goal though.

0 Karma
Highlighted

Re: How to disable scheduled searches via command line interface?

SplunkTrust
SplunkTrust

Let's get out of the habit of adding a password to our curls, which would then end up in os logs.

curl -ku admin https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

curl -ku admin https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"

The above will prompt you for password and not reveal it to the world of shoulder surfers and history buffs.

0 Karma
Highlighted

Re: How to disable scheduled searches via command line interface?

Builder

You can also disabled "scheduling capability" in $SPLUNK_HOME/etc/system/{local,default}/default-mode.conf
No scheduled searches willl run ... "ever" on this server.

[pipeline:scheduler]
disabled = true

0 Karma