Hello,
Does anyone know how to pass parameters to a saved search using the splunklib for the Splunk API?
I am able to use it to get results from my saved searches, but now I would like to be able to pass a variable value to my saved search. I've seen a few examples of people using the "curl" approach, but I wanted to see if there was a way to do this by directly using the splunklib for Python.
This is the snippet of code where I retrieve my saved search and then run it.
number_of_users = 10
search_name = "Find Most Recent Users"
mysavedsearch = service.saved_searches[search_name]
job = mysavedsearch.dispatch()
So if I have a saved search named: Find Most Recent Users
And that search looks like: "index=INDEX host=HOST sourcetype=SOURCETYPE | rex field=_raw "User:(?<user_id>\d+) | where isnotnull(user_id) | head $number_of_users$"
How would I pass the variable "number_of_users" into the above?
