REST API

[balcv]

I'm trying to work out how I execute a saved search / report using the REST API.  I have created the token and have all the correct permissions.  An "inline" search in the curl command works and returns the required search results, however I have not been able to successfully get a saved search / report to run.

I know that my saved searches reside in $SPLUNK_Home/etc/users/[user]/[app]/local/savedsearches.conf and I can see the required search of "LV - WiFi Users" in the .conf file.  My problem is how to reference that in the curl api call.

I'm executing:

curl -s -k -H "Authorization: Bearer [key]" "https://[splunk_host]:8089/users/[user]/[app]/local/?output_mode=csv" --data-urlencode search="savedsearch \"LV - WiFi Users\""

and results in "The requested URL was not found on this server." error.

Does anyone have any hints on how I can execute the "LV - WiFi Users"  saved search using a curl API call?

Thanks

[bowesmana]

Take a look at the REST API docs for saved searches

https://help.splunk.com/en/splunk-cloud-platform/rest-api-reference/10.1.2507/search-endpoints/searc...

https://<host>:<mPort>/services/saved/searches/{name}/dispatch

[PickleRick]

But this returns a sid which has to be queried for completion and you have to fetch results, paginate and so on.

You can use the /services/search/v2/jobs/export endpoint to spawn search and stream the results with a "| savedsearch ..." search. But you might want to use the namespace parameter for the call to set proper... well, namespace 🙂