Hi,
This is a follow up question for the same requirement in this question: https://answers.splunk.com/answers/308933/is-it-not-possible-to-run-splunk-cli-savedsearch-w-1.html
I have a requirement where I am invoking a Splunk saved search from a shell script splunk search '|savedsearch "Myreport"
. My savedsearch looks something like this:
index=ABC|mysearch| table a, b, c, d, e
|dboutput database=XXX type=sql "INSERT INTO xyz
(v,w,x,y,z)
VALUES
($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"
How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? $?
is 0 even if the search fails or there is no data to extract. I have to schedule another saved search based on whether the above search was successful or not. If I use stderr, I need to add some more logic to grep for ERROR and INFO. Is there a simpler way of handling the exit status? Thanks in advance for the help!!
I would recommend using the rest api to create a search job with wget or curl. Then you can get the job status and results with a shell script. Other option is to use one of the SDKs.
I would recommend using the rest api to create a search job with wget or curl. Then you can get the job status and results with a shell script. Other option is to use one of the SDKs.
Agree and here is how it can be done.
http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTsearches
See section Create a search job
Thank you. I'll take a look at the link.