Getting Data In

Not able to list out the saved search using REST API

anoopambli
Communicator

I am trying to figure out how to execute a saved search and get the results using the REST API. I have created few saved searches, but I'm not able to list them when I try curl -ks -u admin: https://splunkrest:8089/services/saved/searches. It just shows the default searches.

Any specific permission I need to set on the saved search so that they can be used via REST API?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

curl -ks -u admin: https://splunkrest:8089/servicesNS/-/-/saved/searches
0 Karma

anoopambli
Communicator

I am able to view my saved search properties now. Thanks for your help. When I try to execute REST API call for dispatching the saved search, I get following error message, Any idea?

bash-3.2$ curl -ks -u : https://splunkrestsvc.fmrco.com/servicesNS/-/-/saved/searches/API_Test/dispatch -d force_dispatch=true

<msg type="ERROR">

In handler 'savedsearch': Cannot edit/create a saved search for wildcarded users or applications

0 Karma

anoopambli
Communicator

In handler 'savedsearch': Cannot edit/create a saved search for wildcarded users or applications is the error message.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The endpoint is actually this

 https://splunkrestsvc.fmrco.com/servicesNS/USER/APP/saved/searches.

Once you've the property using first curl, grab the owner/author and the app context and use that for your second dispatch curl.

anoopambli
Communicator

Super cool, that worked. Thanks a ton.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...