Splunk Search

What endpoint for schedule searches?

ben_leung
Builder

Using REST API to call curl command, what is the exact endpoint to hit in order to create a scheduled search with all options like expiration of alerts etc..

0 Karma
1 Solution

emechler_splunk
Splunk Employee
Splunk Employee

I believe the REST API Tutorial will be helpful here, it walks you through this exact example: http://dev.splunk.com/view/rest-api-tutorials/SP-CAAADQ6

curl  -k -u admin:changeme -d "name=web_errors" -d 'search="source%3D*web.log+status>400"' https://localhost:8089/servicesNS/admin/search/saved/searches

All of the options for the search/saved/searches endpoint can be found here (including alert.expires which defines the alert expiration time): http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches

View solution in original post

emechler_splunk
Splunk Employee
Splunk Employee

I believe the REST API Tutorial will be helpful here, it walks you through this exact example: http://dev.splunk.com/view/rest-api-tutorials/SP-CAAADQ6

curl  -k -u admin:changeme -d "name=web_errors" -d 'search="source%3D*web.log+status>400"' https://localhost:8089/servicesNS/admin/search/saved/searches

All of the options for the search/saved/searches endpoint can be found here (including alert.expires which defines the alert expiration time): http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches

_gkollias
SplunkTrust
SplunkTrust

Do you have to manually create the /servicesNS/... directory path, or is this created out of the box?

I can't seem to find it under /opt/splunk

Thanks!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...