Splunk Search

How To Pass Parameters to Saved Search Using Splunklib

Traer001
Path Finder

Hello,

Does anyone know how to pass parameters to a saved search using the splunklib for the Splunk API?

I am able to use it to get results from my saved searches, but now I would like to be able to pass a variable value to my saved search. I've seen a few examples of people using the "curl" approach, but I wanted to see if there was a way to do this by directly using the splunklib for Python.

This is the snippet of code where I retrieve my saved search and then run it.

number_of_users = 10
search_name = "Find Most Recent Users"
mysavedsearch = service.saved_searches[search_name]
job = mysavedsearch.dispatch()

 

So if I have a saved search named: Find Most Recent Users

And that search looks like:  "index=INDEX host=HOST sourcetype=SOURCETYPE | rex field=_raw "User:(?<user_id>\d+) | where isnotnull(user_id) | head $number_of_users$"

 

How would I pass the variable "number_of_users" into the above?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...