Getting Data In

Set default app in ruby api?

st0kes
New Member

The below code snippet will only work if my saved search is saved in the default "search" app.

query = "My Saved Query"
saved_search = splunkService.saved_searches.fetch("#{query}")
search_job = saved_search.dispatch()

How do I modify this so this it will get the query from the "mycustom_app" app? I've experimented with various ideas but nothing seems to work.

Tags (2)
0 Karma
1 Solution

psanford_splunk
Splunk Employee
Splunk Employee

Hi - This trick is to set the namespace in order to pull back the saved search that you want. Also - there is a "bug" in our docs for pulling back metadata of a saved search. NOTE: in the example below I am not using a : to pull back the description of the saved search. We are working to get that corrected ASAP.

Here is the snippet to create a namespace object and then to connect to splunk in that namespace.

ns = Splunk::namespace(:sharing => "app", :app => "testrubySS")
svc = Splunk::connect(:username => 'admin', :password => 'changed', :namespace => ns)

Here is my full example that you can use to test out and see if your namespace has been limited. For example, when you list saved searches prior to applying the namespace you will see everything that is system.

After applying namespace you will just see the saved searches in that app.

require 'splunk-sdk-ruby'

class MyTest

  def initialize()

end

def run

ns = Splunk::namespace(:sharing => "app", :app => "testrubySS")

svc = Splunk::connect(:username => 'admin', :password => 'changed', :namespace => ns)

svc.apps.each do |a|

  puts "App name is: #{a.name}"

end

svc.saved_searches.each do |saved_search|

  puts "Saved search is: #{saved_search.name}" 

end

ruby_ss = svc.saved_searches.fetch("my_ruby_search")

if ruby_ss.nil?
  puts "COULDN'T GET THE SAVED SEARCH"
else
 puts "Description for #{ruby_ss.fetch('description')}"

 testJob = ruby_ss.dispatch()

end

end

end

test = MyTest.new()
test.run

View solution in original post

psanford_splunk
Splunk Employee
Splunk Employee

Hi - This trick is to set the namespace in order to pull back the saved search that you want. Also - there is a "bug" in our docs for pulling back metadata of a saved search. NOTE: in the example below I am not using a : to pull back the description of the saved search. We are working to get that corrected ASAP.

Here is the snippet to create a namespace object and then to connect to splunk in that namespace.

ns = Splunk::namespace(:sharing => "app", :app => "testrubySS")
svc = Splunk::connect(:username => 'admin', :password => 'changed', :namespace => ns)

Here is my full example that you can use to test out and see if your namespace has been limited. For example, when you list saved searches prior to applying the namespace you will see everything that is system.

After applying namespace you will just see the saved searches in that app.

require 'splunk-sdk-ruby'

class MyTest

  def initialize()

end

def run

ns = Splunk::namespace(:sharing => "app", :app => "testrubySS")

svc = Splunk::connect(:username => 'admin', :password => 'changed', :namespace => ns)

svc.apps.each do |a|

  puts "App name is: #{a.name}"

end

svc.saved_searches.each do |saved_search|

  puts "Saved search is: #{saved_search.name}" 

end

ruby_ss = svc.saved_searches.fetch("my_ruby_search")

if ruby_ss.nil?
  puts "COULDN'T GET THE SAVED SEARCH"
else
 puts "Description for #{ruby_ss.fetch('description')}"

 testJob = ruby_ss.dispatch()

end

end

end

test = MyTest.new()
test.run

st0kes
New Member

Brilliant answer, thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...