topic Re: How to create new MACRO using Rest api? in Getting Data In

How to create new MACRO using Rest api?

jadengoho — Fri, 09 Feb 2018 08:10:24 GMT

As of now i follow this code and it works perfectly :

  from splunklib.client import connect
  service = connect(username="admin", password="changeme", host="myhost", app="search")
  service.post('properties/macros/test', definition="test123")
  print service.get('properties/macros/test/definition')["body"]

I see it here https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html
But that code was to update ,

What if i want to add or delete a macro using the code ?

Re: How to create new MACRO using Rest api?

harsmarvania57 — Fri, 09 Feb 2018 08:56:49 GMT

Hi @jadenhoho,

To create macro using Rest API, you can achieve like this

import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.post('properties/macros', __stanza="test")
service.post('properties/macros/test', definition="test123")
print service.get('properties/macros/test/definition')["body"]

I don't have idea about delete one.

Re: How to create new MACRO using Rest api?

jadengoho — Fri, 09 Feb 2018 09:28:28 GMT

Thanks for that it is helpfull ,
i already tried

  import splunklib.client as client
 service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('properties/macros/name')

But it only does disable the macro but not delete it fully,
is there any function that apply that ?

Re: How to create new MACRO using Rest api?

harsmarvania57 — Fri, 09 Feb 2018 10:29:51 GMT

This one worked for me for deleting macro using REST API

import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('/servicesNS/nobody/search/admin/macros/test')

Re: How to create new MACRO using Rest api?

jadengoho — Mon, 12 Feb 2018 00:21:37 GMT

Thank you very much this code really help 🙂