Splunk Search

How can i retrieve the SID of a saved search by curl?

Robertoing
Loves-to-Learn

How can i retrieve the SID of a saved search by curl?

Labels (1)
0 Karma

manjunathmeti
Champion

Then you can call your saved search using /search/jobs:

curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="| savedsearch saved_search_name"

 You'll get SID in the response:

<response><sid>mysearch_02151949</sid></response>

And use /search/jobs/SID/results to get results:

curl -k -u admin:pass https://localhost:8089/services/search/jobs/mysearch_02151949/results

 

If this reply helps you, an upvote/like would be appreciated.

0 Karma

manjunathmeti
Champion

hi @Robertoing ,

You can use below API endpoint.

https://<host>:<mPort>/services/saved/searches/{name}/history

 

Check this for more info: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/RESTREF/RESTsearch#saved.2Fsearches.2F.7B...

 

If this reply helps you, an upvote/like would be appreciated.

 

0 Karma

Robertoing
Loves-to-Learn

If the saved search is scheduled, but my saved search no. How can i start my saved search and get the SID to see the results?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.