Reporting

How to disable schedules for all searches for a particular user?

twinspop
Influencer

I'm attempting with 2 REST calls: 1 to get the list of searches, and 1 to POST is_scheduled = 0.

The list curl command I'm using is:

curl -sku admin:pass https://localhost:8089/servicesNS/baduser/-/saved/searches?count=0

Then I'd like to step through each returned with this curl template:

curl -sku admin:pass https://localhost:8089/servicesNS/baduser/$APP/saved/searches/$SEARCHNAME -d is_scheduled=0

But Splunk is cloning the search, not disabling the schedule. I get the original, and a private copy with no schedule.

I'm missing something basic about the way the API works. Help?

0 Karma

twinspop
Influencer

The list command is borked. It lists all searches baduser can see. Not what baduser owns. Bah!

0 Karma

twinspop
Influencer

Partial answer: If I use nobody in the username slot in the POST command, it works.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>