Is there a way to directly launch a saved search via the scheduler while passing key/value pairs for macro replacement via an API call?
The only place I've seen any reference to macro replacements for saved search is with the savedsearch search command documentation, and it's fairly brief. So I haven't seen anything that talks about how to do this, but that's not too surprising.
Just for the reccord, (because I'm sure someone will point it out)... Simply running a search of "| savedsearch mysavedsearch key=value" is not an option in my particular use case. I need any triggered actions associated with the saved search to be run, and the only way I know of doing that is via the scheduler. So I believe that rules out the possibility of using the savedsearch search command.
My ultimate goal is to do this from Splunk's python API. I can launch a saved search with the scheduler like so, the only piece I'm missing is how to pass in values for macro expansion. Any ideas?
import splunk.saved
job = splunk.saved.dispatchSavedSearch("mysavedsearch", sessionKey=sessionKey, namespace="myapp", owner="owner", triggerActions="1", now=timestamp)
Related stuff:
