Getting Data In

How to query against Splunk API a saved search without the search Id?

Mathanjey
Explorer

Can someone suggest how to query against Splunk API for a saved search without the Search Id? Basically we have a requirement to make a call against Splunk API (REST) for a saved search and get results.

0 Karma

woodcock
Esteemed Legend

You did not describe what your IDE or language are but Splunk SDK dox are here:
http://dev.splunk.com/view/sdks/SP-CAAADP7

If you want to do it via the REST API - then take a look at these two tutorials:
http://dev.splunk.com/view/SP-CAAADQ5
http://dev.splunk.com/view/saved-searches-and-alerting/SP-CAAADRK

REST API reference docs for saved searches are here: http://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D.2...

You call dispatch for the search you care about and then you should be off and running.

0 Karma

woodcock
Esteemed Legend

Did you try this?

0 Karma

koshyk
Super Champion

You can first list all your saved Searches like this

| rest services/search/jobs | search isSavedSearch=1 | stats count by label

then you can specifically interrogate them if needed

| rest services/search/jobs | search label="my special saved search"
0 Karma

Mathanjey
Explorer

I have a saved search and wanted to invoke the saved search via rest api and get results from the api.

0 Karma

woodcock
Esteemed Legend

Are you OK now?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So you want to run the saved search or want to get information about the saved search (and what information if yes)?

0 Karma

woodcock
Esteemed Legend

What he asked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...