Splunk Search

How to use the REST API to fetch and filter results from a saved search?

samkaj
Explorer

I am using REST service - my requirement is to use Splunk REST URL to fetch details from a saved search .. but I want a filter while fetching details. How can I do this?

JL99
Explorer

Here is my sample. I want to get all saved search then from the returned result I want to filter in the field called "search" to find searchstring that contains something like "| collect".

So  

 

| where (search LIKE "%| collect%") 

 

do the job

Full Search String:

 

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search
| where (search LIKE "%| collect%")


Add-On
Let's say I want to filter search a field called "action.summary_index" for the value equals to 1, I can do as below. Enclose the field name with dollar sign ($)

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
| where $action.summary_index$ = "1"

 

0 Karma

AnujaJ
Path Finder
0 Karma

woodcock
Esteemed Legend

Look here:

http://docs.splunk.com/Documentation/Splunk/6.0.9/RESTAPI/RESTsearches#Get_search_results

So from the search bar, like this:

| rest services/search/jobs/<HereIsYourJobID>/results/  | <your filter stuff here>
0 Karma

MuS
Legend

You should provide more details on this, like do you want to query the details of the saved search and filter the details or do you want to get back the search results of a saved search and filter on the search results?

cheers, MuS

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...