Hello Experts,
I'm trying to enable a scheduled search via a rest call. I'm given the name of the search, and when I called something as simple as:
request = urllib2.Request(base_url + '/servicesNS/' + owner + '/MyApp/saved/searches',
data = urllib.urlencode({'name': searchname, 'is_scheduled': "1", 'disabled': 0}),
headers = { 'Authorization': ('Splunk %s' %settings['sessionKey'])})
The error logs informed that they needed a search string. So I pulled the existing search string and fed it, and then it asked for the cron_schedule, and when I fed it that, it created a new copy of the search, but private. What's the right way to modify an existing search, to just enable it?
In response to Martin's question, urllib2 does make a post request when configured with a payload. I can set macros easily by using the following code:
request = urllib2.Request(base_url + '/servicesNS/-/MyApp/properties/macros/' + macroname,
data = urllib.urlencode({'definition': macrovalue}),
headers = { 'Authorization': ('Splunk %s' %settings['sessionKey'])})
search_results = urllib2.urlopen(request)
Additionally, I can see the proper paths being followed in the logs (except for the lack of the modification):
09-09-2014 23:37:08.530 -0700 DEBUG REST_Calls - app=MyApp POST saved/searches id=My Search Name: cron_schedule -> ['9 * * * *'], disabled -> [0], is_scheduled -> [1], search -> [My Search String]
09-09-2014 23:37:08.532 -0700 INFO SavedSearchAdminHandler - handleEdit called for id="My Search Name"
I've also tried mimicing exactly the format of the Macro search above, to no avail:
request = urllib2.Request(base_url + '/servicesNS/' + owner + '/MyApp/saved/searches/My%20Search%20Name',
data = urllib.urlencode({'is_scheduled': "1", 'disabled': 0}),
headers = { 'Authorization': ('Splunk %s' %settings['sessionKey'])})
... View more
