Getting Data In

How do you create saved search using REST API call?

New Member

Works in curl:

curl -k -u admin:changeme http://localhost:8089/servicesNS/admin/search/saved/searches -d name=MySavedSearch --data-urlencode search="index=_internal source=*metrics.log"

The same call from Postman:

http://localhost:8089//servicesNS/admin/launcher/saved/searches?name="MySavedSearch"&search="index=_... source=*metrics.log"

< ERROR">Cannot perform action "POST" without a target name to act on.

What is the target name it complains about? I provided an application name as a target — not good enough?

0 Karma

curl -k -u admin:changeme https://localhost:8089/services/saved/searches \
	-d name=firstApiTest \
	-d disabled=1 \
	-d owner=nobody \
	-d description=descritionText \
	-d search="index=main" \
	-d dispatch.index_earliest=-7d \
	-d dispatch.index_latestlatest=now
0 Karma


Hello @sp04355,

Do you know the distinction between GET and POST requests? If not, you should probably google it. One important difference is that GET parameters are sent as part of the URL whereas POST parameters are sent in the request body after the HTTP headers.

When you browse the REST API Reference Manual then you will see that there are many functions which depend on the type of the request (GET, POST, DELETE...). GET is usually for requesting data whereas POST is for making changes.

Your curl command above will run a POST request which looks like this:

POST /servicesNS/admin/search/saved/searches HTTP/1.1
Authorization: Basic ...
User-Agent: curl/...
Host: localhost
Accept: */*
Content-Length: 66
Content-Type: application/x-www-form-urlencoded


Now I'm not familiar with Postman but from what I can see: You are explicitly putting the parameters in the URL instead of the request body. So you are sending a POST request without any valid parameters. That's why Splunk is complaining that it cannot find the "name=MySavedSearch" parameter.

So I advice to check the Postman documentation on how to send a POST request.

Side note 1: Why do you have "launcher" in the postman URL?
Side note 2: I'm surprised to see that you are using http instead of https.

0 Karma

New Member

Should i add a stanza to the input.conf?
I have the same issue on create index as well.
Please, Splunk gurus? Anybody knows the answer?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!