topic Re: Empty results from rest call in Report in Getting Data In

Empty results from rest call in Report

felipetesta — Wed, 21 Jun 2017 09:03:41 GMT

Hello.
Running 6.6 (paid license) with LDAP authentication. I need to use my own email in a Report. I built a complex search that works, but once it is run as a Report the "| rest" call returns empty. So I tried to save a simpler search:

| rest /services/authentication/current-context | fields + email

When I run it in the free search it returns my address. When I run the Report it returns no data.

Is there something that prevents rest calls in saved searches? Is it a problem with permissions? (but in the simplest test case I am using my own account).

Help.

Re: Empty results from rest call in Report

felipetesta — Wed, 21 Jun 2017 09:31:54 GMT

Additional info. The big plan is to allow any user to authenticate on Splunk and see a read-only dashboard with an analysis of her/his operations as found in indexed logs (such as Country of last access, incoming/outgoing email/antispam statistics, ...). I need to determine their email address automatically and I think there's no other way than the REST call to current-context.

Re: Empty results from rest call in Report

cmerriman — Wed, 21 Jun 2017 17:57:47 GMT

i'm unaware of any permissions/capabilities that would cause this issue. i just ran a super simple search and saved as a report and it seems to work for me, however.
|makeresults|eval data="testdata"|appendcols [| rest /services/authentication/current-context |fields email]

who owns the report? the report (and therefore the rest) will run as the owner of the report, i believe.

Re: Empty results from rest call in Report

felipetesta — Thu, 22 Jun 2017 10:07:57 GMT

The search is owned by me. I modified as shown

Show to Owner: works for owner, others don't see it.
Shared to App, runs as Owner, All R&W: works for owner, others see it amongst Searches but shows no email.
Shared to App, run as User, All R&W: works for owner, others see it amongst Searches but shows no email.

It works in the last configuration if I login as "admin", and admin's email address is shown. But not for other logins.

As admin I tried to share the report to all Apps (Global), same behavior: for normal users the saved search returns nothing.

The "Inspect > Search log" for a working and a non-working case is the same.

Re: Empty results from rest call in Report

jplumsdaine22 — Thu, 22 Jun 2017 12:12:05 GMT

Could be some funky issue with reports. Have you tried just using this search on the dashboard to set a token?

Re: Empty results from rest call in Report

felipetesta — Fri, 23 Jun 2017 14:27:28 GMT

Indeed, looks like an issue with reports. I inserted the full search query into a dashboard panel, gave it full visibility and it finally worked. I tested with three different users. Solved.