Need help deleting a saved search from a search query.

[cgif_ctac]

Hello,

I am trying to create a search that I can use to delete a saved search.
Looking at
https://docs.splunk.com/Documentation/Splunk/7.2.5/RESTREF/RESTlist
https://docs.splunk.com/Documentation/Splunk/7.2.5/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D
for reference, I believe this can be done.

Right now, this is the search I have thus far:
"
| rest splunk_server=local request=DELETE /servicesNS/USERNAME/APPNAME/saved/searches/SavedSearchName
"
However, when I run that this is the error I get:

Any help or guidance is appreciated.
Thanks!

[nvanderwalt_spl · Accepted solution]

Hi

The problem is that you are not allowed to POST OR DELETE from within the UI. You can only make GET requests. You will need to use something like curl to delete the search using REST:

curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch

Note that if the search is shared at an app level, you will have to use the user nobody, and special characters may also give you problems, as the search string needs to be URI encoded.

Pro Tip: look at the id flield in the |rest splunk_server=local /servicesNS/-/-/saved/searches endpoint to see what the encoded path is.

[cgif_ctac]

Hi,
I suppose not being able to use a REST POST request in the GUI explains it.
Thank you for the answer.

[adonio]

i suppose you are to replace the username with the user who owns the search ...

[cgif_ctac]

Yes,
Thank you for the response.
I placed "username" as a placeholder text instead of the actual username I am using. This screenshot was created to show the error text. When I use the actual username, app name and saved search name the error is the same.
I believe the root of the problem is the URL syntax. Which I thought "request=DELETE" would suffice (based of the documentation I read), but it appears that is not the case.