Dispatch saved search

//native

/**

 * Dispatch saved search

 * Run a saved search now and return the search ID (sid) of the job it starts. Take owner and app from the entry's acl in List saved searches.

 */

export async function main(

  auth: RT.Splunk,

  name: string,

  owner: string,

  app: string,

  earliest_time: string | undefined,

  latest_time: string | undefined,

  trigger_actions: boolean | undefined,

  args: { [key: string]: any } | undefined

) {

  const base = auth.base_url.replace(/\/+$/, "")

  const url = `${base}/servicesNS/${encodeURIComponent(owner)}/${encodeURIComponent(app)}/saved/searches/${encodeURIComponent(name)}/dispatch`

  const body = new URLSearchParams({

    output_mode: "json",

    trigger_actions: String(trigger_actions === true),

  })

  if (earliest_time) body.append("dispatch.earliest_time", earliest_time)

  if (latest_time) body.append("dispatch.latest_time", latest_time)

  for (const [k, v] of Object.entries(args ?? {})) {

    if (v != null) {

      body.append(

        `args.${k}`,

        typeof v === "object" ? JSON.stringify(v) : String(v)

      )

    }

  }

  const response = await fetch(url, {

    method: "POST",

    headers: {

      Authorization: `Bearer ${auth.token}`,

      "Content-Type": "application/x-www-form-urlencoded",

      Accept: "application/json",

    },

    body,

  })

  if (!response.ok) {

    throw new Error(`${response.status} ${await response.text()}`)

  }

  return await response.json()

}