Run Saved Search

Runs a saved search in Splunk.

This node is also exposed as an AI Agent tool.

This node has 1 input port and 1 output port.

Common Properties

Every node shares these.

Name — the node's display name on the canvas.
Color — the node's colour on the canvas.
Delay Before (sec) — wait this long before the node runs.
Delay After (sec) — wait this long after the node runs.
Continue On Error — carry on instead of failing the flow. Defaults to false.

info

When Continue On Error is true the error is not raised at all, so a Catch node will not see it either.

Property	Field	Description
Client ID	`inClientID`	Client ID from Connect node
Saved Search Name	`inSearchName`	Name of the saved search to dispatch

Property	Field	Description
Result Count	`outCount`	Number of results returned
Results	`outResults`	Search results as array of objects
Search ID	`outSID`	Dispatched search job ID (SID)

Property	Field	Description
Base URL	`optBaseURL`	Splunk management API URL
Credentials	`optCredentials`	Splunk Auth Token credentials
Max Results	`optMaxResults`	Maximum number of results to return
Skip TLS Verification	`optSkipTLS`	Skip TLS certificate verification
Timeout (seconds)	`optTimeout`	Maximum time in seconds to wait for search to complete

A Client ID from this package's Connect node, unless you set credentials directly on this node.
Splunk Auth Token — Splunk authentication token for REST API access
- value — Auth Token (password, required). Splunk authentication token from Settings > Tokens

Store these in a Vault and reference the vault item from the node, rather than typing the secret into the property.