Reporting

How to disable scheduled searches via command line interface?

pfernandez133
Explorer

Hey guys, I'm looking for a way to disable multiple scheduled searches via command line.

Once a week, we switch one environment on and the other off, so we want to disable searches/alerts for the environment we've disabled. As you may have guessed, it's quite a few searches/alerts that need to be disabled. A command-line method would allow me to script it.

Thanks in advance!

0 Karma

pretzel2
Path Finder

Help vote up these new feature ideas ..   which is for Splunk to create an app or feature within to product to schedule reoccurring disablement of certain scheduled searches/alerts/reports.

https://ideas.splunk.com/ideas/EID-I-181

https://ideas.splunk.com/ideas/EID-I-654

 

0 Karma

lmyrefelt
Builder

You can also disabled "scheduling capability" in $SPLUNK_HOME/etc/system/{local,default}/default-mode.conf
No scheduled searches willl run ... "ever" on this server.

[pipeline:scheduler]
disabled = true

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

you can use the REST endpoint directly either through curl or by programming against it using the SDKs to

curl -ku admin:changeme https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

 eg 

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"

jkat54
SplunkTrust
SplunkTrust

Let's get out of the habit of adding a password to our curls, which would then end up in os logs.

curl -ku admin https://localhost:8089/servicesNS/<owner-name>/<app-name>/saved/searches/<saved-search-name>; -d "is_scheduled=0"

curl -ku admin https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar -d "is_scheduled=0"

The above will prompt you for password and not reveal it to the world of shoulder surfers and history buffs.

0 Karma

pfernandez133
Explorer

Thanks for the suggestion!

I had to set "is_scheduled=true" to get it to flip from 0 to 1, but the search's status is still set to disabled under Manager > Searches and Reports. How can I switch that disabled to enabled?

Thx again!

0 Karma

jrodman
Splunk Employee
Splunk Employee

To be clear, this disables the scheduling aspect, or alert, of the search, instead of disabling the whole search. I think it's the best option for your goal though.

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You should be able to do that by:

curl -ku admin:changeme https://localhost:8089/servicesNS/admin/seach/saved/searches/foobar/enable -d ""

Learn more about our REST API

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...