Reporting

How to start a saved search using REST API

mauhumor
Explorer

How to start a saved search using REST API URL?

I can make a GET the saves searchs, extract the 'search' expression and run it using a POST.

But I could not find any reference on how to start a job passing as an argument a saves search ID instead of the search expression.

Is there a another URL or parameter for that?

Tags (2)
1 Solution

Genti
Splunk Employee
Splunk Employee
curl -k -u admin:changeme -d "search=savedsearch %22Errors%20in%20the%20last%2024%20hours%22" https://localhost:8089/services/search/jobs/

This will call a savedsearch named "Errors in the last 24 hours" - one of the default splunk saved searches..

Check this thread for some more info on how to run rest api searches, how to check if the search has finished, and how to get the results http://answers.splunk.com/questions/8940/

View solution in original post

dishasaxena
Path Finder

You can get the search ID for the saved search by running below command:

curl -k -u user:password https://localhost:8089/servicesNS/admin/search/saved/searches/My_Saved_Search/dispatch -d "trigger_actions=1"

You will get a response like below:

admin__admin__search__RMD53566916a3c467274_at_1376044050_4161

Now you can get the output by running below command:

curl -k -u user:password https://localhost:8089/servicesNS/admin/search/search/jobs/admin__admin__search__RMD53566916a3c46727... --get  -d output_mode=csv -d count=10

Note: admin__admin__search__RMD53566916a3c467274_at_1376044050_4161 is the serach ID you received from output of above command.

jgigliotti
Engager

I use the example to search ID for my saved search however get the following error, any assistance please thanks.

curl -k -u user:password https://localhost:8089/servicesNS/admin/search/saved/searches/My_Saved_Search/dispatch -d "trigger_action=1"


<msg type="ERROR">
 In handler 'savedsearch': Argument "trigger_action" is not supported by this handler.
0 Karma

raugugliaro
New Member

Just FYI for anybody reading this thread its "trigger_actions" not "trigger_action"

0 Karma

Genti
Splunk Employee
Splunk Employee
curl -k -u admin:changeme -d "search=savedsearch %22Errors%20in%20the%20last%2024%20hours%22" https://localhost:8089/services/search/jobs/

This will call a savedsearch named "Errors in the last 24 hours" - one of the default splunk saved searches..

Check this thread for some more info on how to run rest api searches, how to check if the search has finished, and how to get the results http://answers.splunk.com/questions/8940/

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...