@@ -16,112 +16,3 @@ Of special note is the events that can perform actions (`--actions` and
1616invoked as a result of the event firing. Scripts are run out of
1717` $SPLUNK_HOME/bin/scripts/ ` .
1818
19- ```
20- Options:
21- -h, --help show this help message and exit
22- --is_visible=IS_VISIBLE
23- <optional for create> Should the saved search appear
24- under the Seaches & Report menu (defaults to true)
25- --alert_type=ALERT_TYPE
26- <optional for create> The thing to count a quantity of
27- in relation to relation. Required for Alerts. (huh?)
28- --dispatch.max_count=DISPATCH.MAX_COUNT
29- <optional for create> Maximum number of results
30- --action.<action_type>.<custom_key>=ACTION.<ACTION_TYPE>.<CUSTOM_KEY>.
31- <optional for create> A key/value pair that is
32- specific to the action_type. For example, if actions
33- contains email, then the following keys would be
34- necessary: action.email.to=foo@splunk.com and
35- action.email.sender=splunkbot. For scripts:
36- action.script.filename=doodle.py (note: script is run
37- from $SPLUNK_HOME/bin/scripts/)
38- --actions=ACTIONS <optional for create> A list of the actions to fire on
39- alert; supported values are {(email, rss) | script}.
40- For example, actions = rss,email would enable both RSS
41- feed and email sending. Or if you want to just fire a
42- script: actions = script
43- --dispatch.earliest_time=DISPATCH.EARLIEST_TIME
44- <optional for create> The earliest time for the search
45- --is_scheduled=IS_SCHEDULED
46- <optional for create> Does the saved search run on the
47- saved schedule.
48- --dispatch.lookups=DISPATCH.LOOKUPS
49- <optional for create> Boolean flag indicating whether
50- to enable lookups in this search
51- --operation=OPERATION
52- <optional for create> type of splunk operation: list-
53- all, list, create, delete (defaults to list-all)
54- --port=PORT Port number (default 8089)
55- --alert_threshold=ALERT_THRESHOLD
56- <optional for create> The quantity of counttype must
57- exceed in relation to relation. Required for Alerts.
58- (huh?)
59- --dispatch.latest_time=DISPATCH.LATEST_TIME
60- <optional for create> The latest time for the search
61- --alert.supress_keys=ALERT.SUPRESS_KEYS
62- <optional for create> [string] comma delimited list of
63- keys to use for suppress, to access result values use
64- result.<field-name> syntax
65- --namespace=NAMESPACE
66- --scheme=SCHEME Scheme (default 'https')
67- --config=CONFIG Load options from config file
68- --dispatch.spawn_process=DISPATCH.SPAWN_PROCESS
69- <optional for create> Boolean flag whether to spawn
70- the search as a separate process
71- --alert.supress.period=ALERT.SUPRESS.PERIOD
72- <optional for create> [time-specifier] suppression
73- period, use ack to suppress until acknowledgment is
74- received
75- --username=USERNAME Username to login with
76- --alert.digest=ALERT.DIGEST
77- <optional for create> [bool] whether the alert actions
78- are executed on the entire result set or on each
79- individual result (defaults to true)
80- --cron_schedule=CRON_SCHEDULE
81- <optional for create> The cron formatted schedule of
82- the saved search. Required for Alerts
83- --alert_comparator=ALERT_COMPARATOR
84- <optional for create> The relation the count type has
85- to the quantity. Required for Alerts. (huh?)
86- --run_on_startup=RUN_ON_STARTUP
87- <optional for create> Should the scheduler run this
88- saved search on splunkd start up (defaults to false)
89- --realtime_schedule=REALTIME_SCHEDULE
90- <optional for create> Is the scheduler allowed to skip
91- executions of this saved search, if there is not
92- enough search bandwidtch (defaults to true), set to
93- false only for summary index populating searches
94- --alert.expires=ALERT.EXPIRES
95- <optional for create> [time-specifier] The period of
96- time for which the alert will be shown in the alert's
97- dashboard
98- --host=HOST Host name (default 'localhost')
99- --dispatch.max_time=DISPATCH.MAX_TIME
100- <optional for create> Maximum amount of time in
101- seconds before finalizing the search
102- --output_mode=OUTPUT_MODE
103- <optional for all> type of output (atom, xml)
104- --dispatch.buckets=DISPATCH.BUCKETS
105- <optional for create> The number of event buckets
106- (huh?)
107- --password=PASSWORD Password to login with
108- --max_concurrent=MAX_CONCURRENT
109- <optional for create> If the search is ran by the
110- scheduler how many concurrent instances of this search
111- is the scheduler allowed to run (defaults to 1)
112- --search=SEARCH <required for create> splunk search string
113- --dispatch.time_format=DISPATCH.TIME_FORMAT
114- <optional for create> Format string for
115- earliest/latest times
116- --name=NAME <required for all> name of search name to be created
117- --alert.severity=ALERT.SEVERITY
118- <optional for create> [int] Specifies the alert
119- severity level, valid values are: 1-debug, 2-info,
120- 3-warn, 4-error, 5-severe, 6-fatal
121- --alert.supress=ALERT.SUPRESS
122- <optional for create> [bool]whether alert suppression
123- is enabled for this scheduled search
124- --dispatch.ttl=DISPATCH.TTL
125- <optional for create> The TTL of the search job
126- created
127- ```
0 commit comments