Is it possible to create a saved search with an XML or JSON search?

[bytesandwich]

Suppose I've taken (many) saved searches out of some existing splunk, put them through the search/parser endpoint, run a translation against these to change them all, and now I want to put them into a new splunk instance (using the terraform saved_search object or just the python api). Is this possible?

Can I somehow just put the json or xml into the saved search object or can I somehow get the search string for a mutated json search object?

Reference to issue in the terraform repo: splunk/terraform-provider-splunk#42

[fantavlik]

Hi @rschuntigit it doesn't sound like this is a SDK-specific issue, for general questions about Splunk use cases Splunk Community is probably the best place to ask.