Splunk Enterprise

Report with parameter action.email Splunk API / Splunk Web

fst01
Loves-to-Learn Lots

Hello Community

I have some troubles with the option "action.email" in a saved search. I want to create a report with the Splunk API and set the available parameter "action.email" to "true" / "1" (because the default value is false).

I tried it like the below query, but it's not working as expected. After executing it's always the default value (false) and Splunk didn't changed it to  "true" or "1":

 

curl -k -u <splunk_username>:<splunk_password> https://<splunk_ip>:<splunk_mgmt-port>/servicesNS/<user>/<app>/saved/searches -d name=Test_Report -d action.email=1 --data-urlencode -d search="<splunk_query>"

 

In a second step I tried to edit the report directly in Splunk Web -> Search, Reports, and Alerts -> testReport -> Advanced Edit. But everytime after I saved the report with the new parameter "action.email = 1" it looks like Splunk is reseting this value back to "false".

In my behavior., Splunk only saves the value "true" consistent after I edited the savedsearches.conf file. 

Can you please help my with this problem?

Thanks

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...