Reporting

How do I capture and verify the response (exit status) of this CLI savedsearch in the shell script?

yelkey
Explorer

Hi,

This is a follow up question for the same requirement in this question: https://answers.splunk.com/answers/308933/is-it-not-possible-to-run-splunk-cli-savedsearch-w-1.html
I have a requirement where I am invoking a Splunk saved search from a shell script splunk search '|savedsearch "Myreport". My savedsearch looks something like this:

index=ABC|mysearch| table a, b, c, d, e 
  |dboutput database=XXX type=sql "INSERT INTO xyz 
                          (v,w,x,y,z) 
                          VALUES
                          ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? $? is 0 even if the search fails or there is no data to extract. I have to schedule another saved search based on whether the above search was successful or not. If I use stderr, I need to add some more logic to grep for ERROR and INFO. Is there a simpler way of handling the exit status? Thanks in advance for the help!!

0 Karma
1 Solution

bmacias84
Champion

I would recommend using the rest api to create a search job with wget or curl. Then you can get the job status and results with a shell script. Other option is to use one of the SDKs.

View solution in original post

bmacias84
Champion

I would recommend using the rest api to create a search job with wget or curl. Then you can get the job status and results with a shell script. Other option is to use one of the SDKs.

somesoni2
SplunkTrust
SplunkTrust

Agree and here is how it can be done.
http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTsearches

See section Create a search job

0 Karma

yelkey
Explorer

Thank you. I'll take a look at the link.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...