Reporting

Rest call SPL to change ownership of a saved search

rajim
Path Finder

I know the rest api command to change the ownership of a saved search. Below is the command. I want to know corresponding SPL so that I can issue this query from Splunk web interface and change the ownership.

/servicesNS/user01/search/saved/searches/$_SAVED_SEARCH_NAME_$/acl -d owner=user02 -d sharing=$_SHARING_VALUE_$

Can anyone please help me here?

Labels (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change

View solution in original post

harsmarvania57
Ultra Champion

Hi,

You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change

rajim
Path Finder

Thank you for the clarification and the links.

0 Karma

harsmarvania57
Ultra Champion

Welcome 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...