How to use the REST API to fetch and filter results from a saved search?

[samkaj]

I am using REST service - my requirement is to use Splunk REST URL to fetch details from a saved search .. but I want a filter while fetching details. How can I do this?

[JL99]

Here is my sample. I want to get all saved search then from the returned result I want to filter in the field called "search" to find searchstring that contains something like "| collect".

So  

| where (search LIKE "%| collect%") 

do the job

Full Search String:

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search
| where (search LIKE "%| collect%")

Add-On
Let's say I want to filter search a field called "action.summary_index" for the value equals to 1, I can do as below. Enclose the field name with dollar sign ($)

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
| where $action.summary_index$ = "1"

[AnujaJ]

Here:
https://www.splunk.com/blog/2013/06/18/getting-data-from-your-rest-apis-into-splunk.html#

I used this App. Very simple to configure.

[woodcock]

Look here:

http://docs.splunk.com/Documentation/Splunk/6.0.9/RESTAPI/RESTsearches#Get_search_results

So from the search bar, like this:

| rest services/search/jobs/<HereIsYourJobID>/results/  | <your filter stuff here>

[MuS]

You should provide more details on this, like do you want to query the details of the saved search and filter the details or do you want to get back the search results of a saved search and filter on the search results?

cheers, MuS