Getting Data In

How to get the SID (via rest api) for a single scheduled report previously created from the Web UI

wmoy
New Member

I have a number of scheduled reports previously created via the WEB UI following a template similar to the ones shown below as the report name.

  • [Report-devicename1] app name denies
  • [Report-devicename1] app name allows
  • [Report-devicename2] app name denies
  • [Report-devicename2] app name>allows

I am able to get the sid for All the scheduled report with https:..../search/jobs --get output_mode=csv,
but how can I get the sid for just a particular report for example, "[Report-devicename2] app name denies" with the rest api is where I'm having trouble.

Thanks in advance.

0 Karma
1 Solution

DavidHourani
Super Champion
0 Karma

wmoy
New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma

DavidHourani
Super Champion
0 Karma

wmoy
New Member

Hello David,

No joy...

Tried the "...saved/searches/{name}/history" after converting to uri-encode format for "name" and the response was a http/404 with an response message starting with ERROR">Cannot find saved search with name...." the string reported back as the "name" was correct.

As a sanity check, I went to the Web UI and was successful in bringing up the report...

0 Karma

DavidHourani
Super Champion

Did you try going to the REST endpoint URL directly in your browser ? Is that what u mean by tried via the Web UI ?
Start from there, if you can see the data then making the |REST command should br easy. Let me know if you got nothing and I'll link u the rest command.

0 Karma

wmoy
New Member

David,

The "|REST" command was the clue that help me figured out the correct api syntax.

Thanks for your help !.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...