Not all dashboards have links to their searches (IME, most do not). Instead, the searches are inline. To replicate a dashboard using the API, you'd have to use the data/ui/views call to get the eai:data field. Then you'll need to parse that field to extract the <input> elements (so you know what the inputs are) and the <panel> elements. Each will contain a <search>, which may be an in-line search or may invoke a savedsearch using either the loadjob or savedsearch command. The <input> elements will define one or more tokens. Any search that uses a token will not run until that token is defined. This is the "trigger" you've noticed. Your code will have to get the proper input from the user so it can set the tokens needed by the searches. Once the tokens are defined, you can fill in the missing parts of the searches and use the REST API to invoke them. The API will return a search ID, which you will use to periodically poll Splunk to see if the search has completed or not. Once the search is complete, you can use another API call to retrieve the results.
... View more
