Splunk Search

Deleting several saved searches in one call

strive
Influencer

Hi,

I am using Splunk REST API to delete saved searches in my java program. I would like to delete several saved searches in one call. Is it possible?

I tried something like:
DELETE saved/searches/{name,name1,name2}

and it did not work.

Thanks

Strive

Tags (1)
1 Solution

Damien_Dallimor
Ultra Champion

No , you can only delete 1 Saved Search per HTTP DELETE request to the REST endpoint

But you could easily write your own wrapper method using the Java SDK, albeit several HTTP calls will still be getting invoked in the background.

public void deleteSavedSearches(List<String>savedSearchNames){

    Map<String, Object> connectionArgs = new HashMap<String, Object>();
    connectionArgs.put("host", "mysplunkserver");
    connectionArgs.put("username", "fred");
    connectionArgs.put("password", "flintstone");

    Service splunkService = Service.connect(connectionArgs);

    SavedSearchCollection savedSearches = splunkService.getSavedSearches();

    for(String savedSearchName:savedSearchNames)
        savedSearches.remove(savedSearchName);

}

View solution in original post

0 Karma

Damien_Dallimor
Ultra Champion

No , you can only delete 1 Saved Search per HTTP DELETE request to the REST endpoint

But you could easily write your own wrapper method using the Java SDK, albeit several HTTP calls will still be getting invoked in the background.

public void deleteSavedSearches(List<String>savedSearchNames){

    Map<String, Object> connectionArgs = new HashMap<String, Object>();
    connectionArgs.put("host", "mysplunkserver");
    connectionArgs.put("username", "fred");
    connectionArgs.put("password", "flintstone");

    Service splunkService = Service.connect(connectionArgs);

    SavedSearchCollection savedSearches = splunkService.getSavedSearches();

    for(String savedSearchName:savedSearchNames)
        savedSearches.remove(savedSearchName);

}
0 Karma

strive
Influencer

After we found out that it is not possible, we implemented it like how you have mentioned. Thank you Damien.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...