Rest call SPL to change ownership of a saved search

[rajim]

I know the rest api command to change the ownership of a saved search. Below is the command. I want to know corresponding SPL so that I can issue this query from Splunk web interface and change the ownership.

/servicesNS/user01/search/saved/searches/$_SAVED_SEARCH_NAME_$/acl -d owner=user02 -d sharing=$_SHARING_VALUE_$

Can anyone please help me here?

[harsmarvania57 · Accepted solution]

Hi,

You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change

[rajim]

Thank you for the clarification and the links.

[harsmarvania57]

Welcome 🙂