Splunk Search
Highlighted

Need help deleting a saved search from a search query.

New Member

Hello,

I am trying to create a search that I can use to delete a saved search.
Looking at
https://docs.splunk.com/Documentation/Splunk/7.2.5/RESTREF/RESTlist
https://docs.splunk.com/Documentation/Splunk/7.2.5/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D
for reference, I believe this can be done.

Right now, this is the search I have thus far:
"
| rest splunk_server=local request=DELETE /servicesNS/USERNAME/APPNAME/saved/searches/SavedSearchName
"
However, when I run that this is the error I get:
alt text

Any help or guidance is appreciated.
Thanks!

0 Karma
Highlighted

Re: Need help deleting a saved search from a search query.

SplunkTrust
SplunkTrust

i suppose you are to replace the username with the user who owns the search ...

0 Karma
Highlighted

Re: Need help deleting a saved search from a search query.

New Member

Yes,
Thank you for the response.
I placed "username" as a placeholder text instead of the actual username I am using. This screenshot was created to show the error text. When I use the actual username, app name and saved search name the error is the same.
I believe the root of the problem is the URL syntax. Which I thought "request=DELETE" would suffice (based of the documentation I read), but it appears that is not the case.

0 Karma
Highlighted

Re: Need help deleting a saved search from a search query.

Splunk Employee
Splunk Employee

Hi

The problem is that you are not allowed to POST OR DELETE from within the UI. You can only make GET requests. You will need to use something like curl to delete the search using REST:

curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch

Note that if the search is shared at an app level, you will have to use the user nobody, and special characters may also give you problems, as the search string needs to be URI encoded.

Pro Tip: look at the id flield in the |rest splunk_server=local /servicesNS/-/-/saved/searches endpoint to see what the encoded path is.

View solution in original post

0 Karma
Highlighted

Re: Need help deleting a saved search from a search query.

New Member

Hi,
I suppose not being able to use a REST POST request in the GUI explains it.
Thank you for the answer.

0 Karma