Getting Data In

Does anyone know how to convert a savedsearch request to a REST API endpoint request?

kmugglet
Communicator

Does anyone know how to convert this savedsearch request to a REST endpoint request?

|savedsearch mysearch replace_me="value"

I can run a normal savedsearch "apm_cvc_qtr_bh_test" using curl in the app apm_snpm

curl -k -u svc_user_bob:password https://localhost:8089/servicesNS/svc_user_bob/apm_snpm/saved/searches/apm_cvc_qtr_bh_test/dispatch -d trigger_actions=1

but i don't know how to pass the replace_me key and value

Any ideas?

1 Solution

kmugglet
Communicator

For the rest call

curl -k u user:password https://blah.local:8089/servicesNS/svc_usr_bob/apm_snpm/saved/searches/apm_cvc_qtr_bh_test/dispatch -d trigger_actions=1 -d args.startDate="-3d" -d args.endDate="-0d"

in the saved search

eventtype=service-CombinedForwardingPlaneQueueGroupServiceIngressLogRecord earliest=$args.startDate$ latest=$args.endDate$

I should work for the NSA after decrypting the Splunk doco

View solution in original post

kmugglet
Communicator

For the rest call

curl -k u user:password https://blah.local:8089/servicesNS/svc_usr_bob/apm_snpm/saved/searches/apm_cvc_qtr_bh_test/dispatch -d trigger_actions=1 -d args.startDate="-3d" -d args.endDate="-0d"

in the saved search

eventtype=service-CombinedForwardingPlaneQueueGroupServiceIngressLogRecord earliest=$args.startDate$ latest=$args.endDate$

I should work for the NSA after decrypting the Splunk doco

somesoni2
Revered Legend

See this example

http://answers.splunk.com/answers/8945/how-to-start-a-saved-search-using-rest-api.html

you can just give your "|savedsearch" command as search query in curl.

0 Karma

kmugglet
Communicator

Thanks, but I couldn't see in there how to pass the values for a template search...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...