Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get result of a scheduled saved search with rest api ?

$
0
0
Hello, I am using curl command to get result of a scheduled search with a specific user. This user (MyUser) has the following capabilites : rest_properties_get rest_properties_set search schedule_rtsearch schedule_search The scheduled search is own by MyUser, and can be read and edited. Then, the curl command I am using are : curl -u MyUser -k https://localhost:8089/services/search/jobs -d "search=| savedsearch MyScheduledSearch" curl -u MyUser -k https://localhost:8089/services/search/jobs/SID/results --get -d "output_mode=csv" > /tmp/fichier_export.csv The SID is well returned by the first command but the second one is not returning any result. I tried with the "admin" user and it works well. I don't understand why it fails with MyUser, it is probably a capabilites problem or Search head clustering problem. Has anyone already faced this problem ?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>