Splunk ' s REST interface provides an action endpoint for disabling a saved search. The appropriate request is an HTTP POST to the saved-search resource ' s /disable action:
curl -k -u admin:pass \
https://localhost:8089/servicesNS/admin/search/saved/searches/TestSearchDevelopment/disable \
-X POST
The key distinction is between operating on the saved-search resource itself and invoking an action against it. DELETE would attempt to remove the saved search entirely rather than merely disabling it. PUT is generally used to update or replace resource state, but Splunk ' s action-style REST endpoints such as /disable are invoked using POST .
This is useful during detection development because an engineer may temporarily disable a scheduled search after validating its behavior, preventing unnecessary execution while preserving the object and its configuration for further development.
The supplied course material covers REST methods, Splunk/SOAR API communication, and automation concepts, but this exact cURL question is not present verbatim in the uploaded question set.
Study Guide topics: Splunk REST API, saved searches, HTTP POST, detection lifecycle, scheduled-search management, API testing.
