Reporting

Rest call SPL to change ownership of a saved search

rajim
Path Finder

I know the rest api command to change the ownership of a saved search. Below is the command. I want to know corresponding SPL so that I can issue this query from Splunk web interface and change the ownership.

/servicesNS/user01/search/saved/searches/$_SAVED_SEARCH_NAME_$/acl -d owner=user02 -d sharing=$_SHARING_VALUE_$

Can anyone please help me here?

Labels (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change

View solution in original post

harsmarvania57
Ultra Champion

Hi,

You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change

rajim
Path Finder

Thank you for the clarification and the links.

0 Karma

harsmarvania57
Ultra Champion

Welcome 🙂

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...