Hi - Have you seen the saved search REST API docs? http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D....
We also have examples in our SDKs.
Java: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY#runsavedargs
C#: http://dev.splunk.com/view/csharp-sdk/SP-CAAAEQF#runsavedargs
The mentioned doc explains how to create/update/delete "saved search". But seems like that API does not allow to enable/disable action.email and enable/disable a schedule of that search. Am I missing something or I have to go to Web UI and check the checkboxes in order to enable/disable those options ?
I am not talking about rescheduling but about enabling "Schedule Alert" feature
and also "Enable Email" checkbox inside
For scheduling: Check out these links:
Check the scheduled_times attribute for a list of epoch times.
Hi - Have you seen the saved search REST API docs? http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearch#saved.2Fsearches.2F.7Bname.7D....
We also have examples in our SDKs.
Java: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY#runsavedargs
C#: http://dev.splunk.com/view/csharp-sdk/SP-CAAAEQF#runsavedargs