How can i retrieve the SID of a saved search by curl?
Then you can call your saved search using /search/jobs:
curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="| savedsearch saved_search_name"
You'll get SID in the response:
And use /search/jobs/SID/results to get results:
curl -k -u admin:pass https://localhost:8089/services/search/jobs/mysearch_02151949/results
If this reply helps you, an upvote/like would be appreciated.
hi @Robertoing ,
You can use below API endpoint.
Check this for more info: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/RESTREF/RESTsearch#saved.2Fsearches.2F.7B...
If the saved search is scheduled, but my saved search no. How can i start my saved search and get the SID to see the results?