Splunk Dev

How to create a simple alert using REST API

Manware
Engager

Hi,

I am unable to create a simple alert using the following documentation. 

As per documentation, the required parameters are Search and name.

Following code is written in Javascript

Here is my request:

const data = {
"alert_comparator": "equal to",
"alert_threshold": "0",
"alert_type": "number of events",
"cron_schedule": "*/1 * * * *",
"search": "index%3D%22global-events-qa%22%20functionName%3D%22correspondence-service%22",
"name": "Simple alert"
}
const response = await axios.post(' https://app.splunkcloud.com:8089/services/saved/searches', data,{
headers: { ...(await getAuth({region: 'ap-southeast-2'}))}
});

Here is the error: 

Cannot perform action "POST" without a target name to act on.

Documentation Link: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch?_ga=2.62077416.557388192.1646...

It will be really great if you could share some working examples somewhere in your documentation. 

Thanks in advance!

Labels (1)
0 Karma
1 Solution

Manware
Engager

Thanks @richgalloway . I saw that example before. that's curl + XML. I was looking for an example with a json format. 

After fiddling with it for some time, I came to know that the 'data' in above request has to be url encoded. then it worked fine.

cheers

View solution in original post

Manware
Engager

Thanks @richgalloway . I saw that example before. that's curl + XML. I was looking for an example with a json format. 

After fiddling with it for some time, I came to know that the 'data' in above request has to be url encoded. then it worked fine.

cheers

richgalloway
SplunkTrust
SplunkTrust

The linked documentation does have examples.  Click on the [Expand] link then scroll past the argument tables to find the examples.

The example for creating a search uses a name without spaces.  I wonder if that will make a difference.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...