Splunk Dev

How to Pass span from REST API call

splunkingsplunk
Explorer

Hi Everyone,

I am getting data to our monitoring dashboards from splunk. The dashboards display data for 2hr, 24hrs, 7 days. So I am able to provide earliest and latest time from rest api to the saved search. but also i have to change timechart span based on timeperiod(2hr:-span=5min , 24hrs:- span=1hr 7days:-span=1day). is there any away i can also pass span parameter to the saved search. so that i can minimize my saved searches from 20 to 5.

Tags (3)

ineeman
Splunk Employee
Splunk Employee

Great question - I had to go ask someone 🙂

The answer is that yes, you can. If you create saved search called "Foo" with a query like this:

index=_internal | timechart span=$span$ count

You can then execute it by executing a search like this:

| savedsearch Foo span=1d

So from the REST API perspective, you would make a POST request to the search/jobs endpoint with the search parameter set to the above query.

Hopefully that makes sense - let me know if you need nay more clarification.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...