Work with reports (saved searches) using Splunk SDK for C#

This topic focuses on working with reports (also known as saved searches) programmatically using the Splunk SDK for C#. For more information about working with search jobs, see How to run searches and jobs.

The report APIs

The classes for working with reports are:

Access these classes through an instance of the Service class. Access a collection of reports using the Service.SavedSearches property. From there you can access individual items in the collection and create new ones. For example, here's a simplified program (from saved-searches) for creating a new report:

// connect to Splunk Enterprise
var service = new Service(connectArgs);
service.LogOnAsync(username, password);
 
// delete report/saved search if it exists already
SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync("example_search");
if (savedSearch != null) 
{ 
    await savedSearch.RemoveAsync(); 
}
 
// create a new report/saved search
savedSearch = await service.SavedSearches.CreateAsync("example_search", "search index=_internal | head 10");