Modify a Splunk Saved Search via Python, using Requests

splunk_modify_saved_search.py

import time # need for sleep
from xml.dom import minidom

import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

base_url = 'https://localhost:8089'
username = 'admin'
password = 'changeme'

app = "search"
saved_search_name = "search_name"
new_spl = "index=*"

r = requests.get(base_url+"/servicesNS/admin/search/auth/login",
	data = {'username':username,'password':password},
	verify = False)

session_key = minidom.parseString(r.text).getElementsByTagName('sessionKey')[0].firstChild.nodeValue
print ("Session Key:", session_key)

r = requests.post(base_url + '/servicesNS/'+username+'/'+app+'/saved/searches/'+saved_search_name,
	headers = { 'Authorization': ('Splunk %s' %session_key)},
	data = {'search': new_spl},
	verify = False)

print(r.text)