Splunk Search

How to use the REST API to fetch and filter results from a saved search?

samkaj
Explorer

I am using REST service - my requirement is to use Splunk REST URL to fetch details from a saved search .. but I want a filter while fetching details. How can I do this?

JL99
Explorer

Here is my sample. I want to get all saved search then from the returned result I want to filter in the field called "search" to find searchstring that contains something like "| collect".

So  

 

| where (search LIKE "%| collect%") 

 

do the job

Full Search String:

 

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search
| where (search LIKE "%| collect%")


Add-On
Let's say I want to filter search a field called "action.summary_index" for the value equals to 1, I can do as below. Enclose the field name with dollar sign ($)

| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
| where $action.summary_index$ = "1"

 

0 Karma

AnujaJ
Path Finder
0 Karma

woodcock
Esteemed Legend

Look here:

http://docs.splunk.com/Documentation/Splunk/6.0.9/RESTAPI/RESTsearches#Get_search_results

So from the search bar, like this:

| rest services/search/jobs/<HereIsYourJobID>/results/  | <your filter stuff here>
0 Karma

MuS
SplunkTrust
SplunkTrust

You should provide more details on this, like do you want to query the details of the saved search and filter the details or do you want to get back the search results of a saved search and filter on the search results?

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...