Splunk Enterprise

Report with parameter action.email Splunk API / Splunk Web

fst01
Loves-to-Learn Lots

Hello Community

I have some troubles with the option "action.email" in a saved search. I want to create a report with the Splunk API and set the available parameter "action.email" to "true" / "1" (because the default value is false).

I tried it like the below query, but it's not working as expected. After executing it's always the default value (false) and Splunk didn't changed it to  "true" or "1":

 

curl -k -u <splunk_username>:<splunk_password> https://<splunk_ip>:<splunk_mgmt-port>/servicesNS/<user>/<app>/saved/searches -d name=Test_Report -d action.email=1 --data-urlencode -d search="<splunk_query>"

 

In a second step I tried to edit the report directly in Splunk Web -> Search, Reports, and Alerts -> testReport -> Advanced Edit. But everytime after I saved the report with the new parameter "action.email = 1" it looks like Splunk is reseting this value back to "false".

In my behavior., Splunk only saves the value "true" consistent after I edited the savedsearches.conf file. 

Can you please help my with this problem?

Thanks

Labels (1)
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...