topic Re: Why is API change not updated in web page? in Splunk Dev

Why is API change not updated in web page?

MScottFoley — Thu, 05 Jan 2023 18:08:27 GMT

I updated an alert description using the REST API (port 8089). When I use the API to list the description it shows the updated description. When I look at the alert using the web page (port 8000) it still has the old version. There are multiple instances of Splunk and a load balancer, but I do not know the specifics. I always use the same IP address to access Splunk.

For the API access I use a token under my username. Is my token the problem? My user has enough rights to create and change alerts. Although when I list all alerts using |rest/servicesNS/-/-/saved/searches I get a warning Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability

Thanks.

Re: Why is API change not updated in web page?

richgalloway — Thu, 05 Jan 2023 18:13:22 GMT

If the Splunk instances are a Search Head cluster then changes made to one should be reflected in the others within a few minutes at most. Sometimes, page caches can cause old data to be displayed. Try holding down the shift key as you refresh the page. If that doesn't help, clear your browser cache or use incognito mode.

You can use the splunk_server=local option to the rest command to suppress that warning. Saved searches are only on the SH, anyway, so there's no need to send the request to the indexers.

Re: Why is API change not updated in web page?

MScottFoley — Thu, 05 Jan 2023 19:10:04 GMT

Thanks Rich,

I thought it could be the cluster. If I update the alert from one computer and then look at it from another (on a different network) it is updated on both. Viewing the alert using the API does not show the change though. It's like the API is changing and reading a local version of the alert. I have asked internally about this problem too.

Re: Why is API change not updated in web page?

MScottFoley — Thu, 05 Jan 2023 20:26:57 GMT

It may be the way I am accessing Splunk through the API. I am using my user since the API token is for my user. $"{splunkBaseUrl}/servicesNS/{user}/search/saved/searches/";

There is documentation that says to use https://<host>:<mPort>/services/alerts/alert_actions. I think I had tried that before and could not get it to work with the API token I was using at least.

I will try using a different endpoint.