I am trying to create a search that I can use to delete a saved search.
for reference, I believe this can be done.
Right now, this is the search I have thus far:
| rest splunk_server=local request=DELETE /servicesNS/USERNAME/APPNAME/saved/searches/SavedSearchName
However, when I run that this is the error I get:
Any help or guidance is appreciated.
Thank you for the response.
I placed "username" as a placeholder text instead of the actual username I am using. This screenshot was created to show the error text. When I use the actual username, app name and saved search name the error is the same.
I believe the root of the problem is the URL syntax. Which I thought "request=DELETE" would suffice (based of the documentation I read), but it appears that is not the case.
The problem is that you are not allowed to POST OR DELETE from within the UI. You can only make GET requests. You will need to use something like curl to delete the search using REST:
curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch
Note that if the search is shared at an app level, you will have to use the user nobody, and special characters may also give you problems, as the search string needs to be URI encoded.
Pro Tip: look at the id flield in the
|rest splunk_server=local /servicesNS/-/-/saved/searches endpoint to see what the encoded path is.
I suppose not being able to use a REST POST request in the GUI explains it.
Thank you for the answer.