Execute Saved Search
execute_saved_searchRun saved Splunk searches by name, with optional time overrides. Choose oneshot for immediate results or job mode for progress tracking and large result sets. Results respect user permissions.
Instructions
Run a saved search by name with optional time overrides and mode selection. Use this to execute existing reports/automations quickly. Choose 'oneshot' for immediate results or 'job' for progress tracking and large result sets.\n\nOutputs: first result page, paging fields, job_id, and Splunk Web job links. If has_more is true, call get_search_job_results with job_id and offset=next_offset.\nSecurity: execution and results are constrained by the authenticated user's permissions.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | ||
| mode | No | oneshot | |
| name | Yes | ||
| owner | No | ||
| latest_time | No | ||
| max_results | No | ||
| earliest_time | No |