{"id":"f8dc9e0d-76a8-43bd-859c-e0592d24da13","task":"Automate Splunk saved searches and alert actions via the REST API","domain":"docs.splunk.com","steps":["Authenticate to the Splunk REST API (default port 8089) using HTTP Basic auth or a session token obtained from POST /services/auth/login.","Create a saved search that functions as a scheduled alert with POST /servicesNS/{user}/{app}/saved/searches, providing name, search (SPL string), cron_schedule, alert_type, alert_condition, and actions parameters.","Configure an alert action (e.g., webhook or email) by setting alert.track=1 and the relevant action.* parameters on the saved search; list available action types with GET /services/alerts/alert_actions.","Enable or disable an existing alert with POST /servicesNS/nobody/search/saved/searches/{name}/enable or /disable.","Retrieve triggered alert history with GET /services/alerts/fired_alerts and filter by saved search name to confirm the alert is firing as expected."],"gotchas":["Unless you set alert.track=1 (Add to Triggered Alerts), Splunk executes the alert action but does not record it in the fired alerts list, making programmatic monitoring impossible.","Saved searches created via the REST API default to the admin user's namespace; use servicesNS/{user}/{app} paths to scope correctly to the target app and sharing level.","The REST API uses XML by default; append output_mode=json to query strings to receive JSON responses."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:44.112Z"},"url":"https://mcp.waymark.network/r/f8dc9e0d-76a8-43bd-859c-e0592d24da13"}