Role capabilities to change Event Type permissions through REST api

dolxor — Mon, 28 Sep 2020 15:22:48 GMT

Hello.

I'm creating an Event Type like this;

curl -k -u RESTUser:RESTPass https://localhost:8089/servicesNS/RESTUser/search/saved/eventtypes \
    -d name="incident_1" \
    --data-urlencode search=search="src_ip=10.0.0.1 sig_id=10001"

My RESTUser is a member of one role, the 'REST_API_User' which has the following capabilities;

rest_apps_management
rest_apps_view
rest_properties_get
rest_properties_set

Then I want to change this Event Type from a private Event Type to an App-wide Event Type. I do this also through the REST API;

curl -k -u RESTUser:RESTPass https://localhost:8089/servicesNS/RESTUser/search/saved/eventtypes/incident_1/acl \
    -d perms.read=* \
    -d perms.write=* \
    -d sharing=app \
    -d owner=RESTUser

However, now I am denied this action with the following error message;

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">User 'RESTUser' with roles { restuser, rest_api_user } cannot write: /nobody/search/eventtypes/incident_1 { read : [ * ], write : [ admin, power ] }, export: global, removable: no</msg>
  </messages>
</response>

Why does it want to write to /nobody/search/...? I spesificially told it to update RESTUser/search/saved/eventtypes/incident_1 - No mention of /nobody/ ..
Why does it say write : [ admin, power ] - is this the default permission when creating an Event Type?
I even tried to add inheritance to the role REST_API_User, to inherit the role "user", but still no luck. If I login to the GUI with the role User added to me I do not see the "Permissions" link behind the "Sharing Private" for the line of this Event Type.
If I add the RESTUser with admin role - everything works nicely.

I am confused as what to do, as I don't want to give a system admin access to my Splunk just to add and update EventType ACL's. Isn't there a way to create an Event Type and simultaneously set the permissions? It seems to default be set to [ admin, power ].

Any advice out there?

Re: Role capabilities to change Event Type permissions through REST api

gkanapathy — Tue, 17 Dec 2013 21:14:08 GMT

In addition to all the roles and the event type, you must have write permission to the parent app.

Re: Role capabilities to change Event Type permissions through REST api

dolxor — Fri, 24 Jan 2014 11:43:52 GMT

Hello. I will try to give RESTUser write to the app.

topic Role capabilities to change Event Type permissions through REST api in Getting Data In

Role capabilities to change Event Type permissions through REST api

Re: Role capabilities to change Event Type permissions through REST api

Re: Role capabilities to change Event Type permissions through REST api