How to enable/disable a saved search using Python SDK?

[bollam]

Can someone assist me in how to enable and disable the saved searches using python SDK?
I have gone through the docs of python SDK and got how to create and delete but where in I was looking for enabling and disabling the saved searches. Prompt response would be highly appreciated.

[bollam]

Hi @paramagurukarthikeyan, How do we enable/disable the saved search which contains the special character in it? I'm getting error while trying enable/disable saved search. Saved search I'm trying to disable is "Testing@#splunk". I'm able to create the saved search with this name but disable is not working. Can you help on this as well?

[bollam]

Any luck??

[bollam]

@ paramagurukarthikeyan, Thanks much!! Its working as expected.

[paramagurukarth]

Always Welcome

[paramagurukarth · Accepted solution]

Please try below..

import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

for ss in service.saved_searches:
    print ss.name
    ss.disable()

[cmerriman]

do you mean turning on or off a schedule?

[bollam]

Yes, Exactly

[harsmarvania57]

Hi @bollam,

Can you please try below python code for disabling saved search

import splunk.rest as rest
rest.simpleRequest('/servicesNS/<USER>/<APPNAME>/saved/searches/<YOURSEARCH>', sessionKey=sessionKey, postargs={'disabled': 1}, method='POST', raiseAllErrors=True)

And to enable it again

import splunk.rest as rest
rest.simpleRequest('/servicesNS/<USER>/<APPNAME>/saved/searches/<YOURSEARCH>', sessionKey=sessionKey, postargs={'disabled': 0}, method='POST', raiseAllErrors=True)

[bollam]

Hi @harsmarvania57 ,
I have written code snippet for a basic query validation. Upon successful validation, It should either create, delete, enable or disable the saved search I provide. It was working for creating and deleting the saved search but I'm finding hard to enable or disable the saved search using python SDK. Is there a way to disable or enable the saved search using python SDK?

[harsmarvania57]

What's your code snippet ? Have you tried code which I have given in my first comment ?