topic Re: Sending HTTP DELETE request using splunk's 'rest' command in Getting Data In

Sending HTTP DELETE request using splunk's 'rest' command

paramagurukarth — Tue, 17 Mar 2015 07:34:11 GMT

Please let me know if there any way to send a HTTP request to splunk REST end point using splunk's rest (http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Rest) command with HTTP DELETE method

Re: Sending HTTP DELETE request using splunk's 'rest' command

Patient — Tue, 17 Mar 2015 09:53:21 GMT

Hi,
If I've understood what you need, I will like to let You know that you can set this stanza [:] in the restmap.conf.spec file. Applicable to all REST stanzas
Stanza definitions below may supply additional information for these.

   [<rest endpoint name>:<endpoint description string>]
 * match=<path> to  Specify the URI that calls the handler.
 * capability.<post|delete|get|put>=<capabilityName>
 * Depending on the HTTP method, check capabilitieson the authenticated session user.
 * If you use 'capability.post|delete|get|put,' then the associated
   method is checked

Re: Sending HTTP DELETE request using splunk's 'rest' command

gwobben — Tue, 03 May 2016 09:51:28 GMT

I downvoted this post because not related to the question

Re: Sending HTTP DELETE request using splunk's 'rest' command

gwobben — Tue, 03 May 2016 09:52:09 GMT

The rest command in Splunk can only do GET requests

Re: Sending HTTP DELETE request using splunk's 'rest' command

paramagurukarth — Tue, 03 May 2016 12:10:51 GMT

Splunk REST will return xml in ODATA format...
For example, https://localhost:8089/servicesNS/-/search/saved/searches

This search will return list of saved searches..
One **** tag for each saved searches
Each entry tag contains child tags **** (More than one) , these tag contains URLs related to that particular saved search and the relation is defined by the attribute "rel"..
Pick the one with "rel" as "remove" and send a ajax request with http_method DELETE or use any REST Clients (Post Man REST client plugin for chrome).. you can remove it