Reporting

Is it possible to run a saved search on a remote splunk server using the rest search command?

responsys_cm
Builder

I'm wondering if there is an equivalent way to do this with the rest search command:

curl -k -u admin:changeme -d "search=savedsearch CIF%3Adomain_botnet" -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export -o domain_botnet.csv

That runs the saved search called CIF:domain_botnet.

Is that possible?

Thx.

Craig

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi responsys_cm,

sure, have you seen the saved search REST API docs?

There are also some examples in the SDKs available:
For Java - http://dev.splunk.com/view/java-sdk/SP-CAAAEKY#runsavedargs

For C# - http://dev.splunk.com/view/csharp-sdk/SP-CAAAEQF#runsavedargs

hope this helps ...

cheers, MuS

responsys_cm
Builder

I looked through the API doc, though I'm not a developer...

It would seem that something like this should work:

| rest /servicesNS/craig/saved/searches/InputDomain/dispatch splunk_server=10.10.10.10 get-arg-name="dispatch.now" get-arg-value="true"

But that never gets any results. Nor does it produce any kind of error.

I'm also unclear on how to authenticate to the remote Splunk server using the rest command...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...