Dashboards & Visualizations

How to pass the additional arguments/parameters to the saved search using Splunk Java SDK?

Kukkadapu
Path Finder

Hi,..

I've implemented the Java SDK for Splunk and I'm able to pass the time arguments and it's working as expected. I'm trying to add additional parms/arguments in the saved search and pass the value from the code. It doesn't work. Which arguments do I need to use to pass the additional parameters?

Saved Search:

source="abc.log" index="index1" | search host=$temp$| stats count(host)

Java Code:

SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.setDispatchEarliestTime("1460590443"); 
dispatchArgs.setDispatchLatestTime("1460703600");
**dispatchArgs.put("temp", "host1");**    

Job jobSavedSearch = null;    
SavedSearch savedSearches1 = service.getSavedSearches().get("SavedSearchName");    
jobSavedSearch = savedSearches1.dispatch(dispatchArgs);

Error :

Exception in thread "main" com.splunk.HttpException: HTTP 400 -- 
 In handler 'savedsearch': Argument "temp" is not supported by this handler.

What arguments should I pass from the code?

Thanks

0 Karma

kirillchokparov
Explorer

It works if add "args." before argument name. For example the saved search (with the name "findSurname") is:

host=my_host field1=$args.surname$

then you can do:

    SavedSearch savedSearch = splunkService.getSavedSearches().get("findSurname"); //get your saved search by name

    SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
   dispatchArgs.add("args.surname", "IVAN*");

    Job job = savedSearch.dispatch(dispatchArgs);

    while(!job.isDone()){
        try {
            Thread.sleep(500);
        } catch (InterruptedException ex) {
            System.out.println("Waiting thread was interrupted: " + ex.toString());
        }
    }

    try{
        Args outputArgs = new Args();
        outputArgs.put("output_mode","json");

        InputStream inputStream = job.getEvents(outputArgs);
        byte[] buffer = new byte[4096];

        while(inputStream.read(buffer)!=-1){
            System.out.println(new String(buffer));
        }
    }catch(Exception ex){
        System.out.println("Error getting result from Splunk: " + ex.toString());
    }

Also you can see some examples about saved searches with Splunk SDK here: http://dev.splunk.com/view/java-sdk/SP-CAAAEKY

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...