search

splunk / splunk-sdk-python

Splunk Software Development Kit for Python
http://dev.splunk.com
Apache License 2.0
687 stars 369 forks source link

Is it possible to create a saved search with an XML or JSON search? #360

Closed bytesandwich closed 2 years ago

bytesandwich commented 3 years ago

Suppose I've taken (many) saved searches out of some existing splunk, put them through the search/parser endpoint, run a translation against these to change them all, and now I want to put them into a new splunk instance (using the terraform saved_search object or just the python api). Is this possible?

Can I somehow just put the json or xml into the saved search object or can I somehow get the search string for a mutated json search object?

Reference to issue in the terraform repo: https://github.com/splunk/terraform-provider-splunk/issues/42

fantavlik commented 2 years ago

Hi @rschuntigit it doesn't sound like this is a SDK-specific issue, for general questions about Splunk use cases Splunk Community is probably the best place to ask.