topic Re: How to change permissions for a job through the REST API/Python SDK? in Getting Data In

How to change permissions for a job through the REST API/Python SDK?

chrishartsock — Wed, 11 Jul 2018 19:32:30 GMT

I am doing some automation in which I am running some searches through the API, and if any results are found, it emails the link to the job to some users. Everything works as desired except for the fact that, by default, jobs are private so the users do not have access. Is there anyway to programatically change the read permissions to everyone for a job?

Thanks

Re: How to change permissions for a job through the REST API/Python SDK?

adauria_splunk — Tue, 29 Sep 2020 20:30:13 GMT

Here are a couple ideas from my colleagues:

Go into the UI and change a search job permissions (either “share” or “extend job lifetime”) and then check splunkd_rest_access.log around the same time (index=_internal source= splunkd_rest_access.log) and see how the UI uses REST to make the change. Splunk Web is simply a front end for the REST API, so if it can be done there it can be done in the API – the trick is seeing how the UI does it (which that search should help you with).

You can also just try to modify the eai:acl.perms.read, eai:acl.perms.write, or eai:acl.sharing properties via a /services/search/jobs/{search_id} POST

Please let us know if either of these lead you to the answer.

Re: How to change permissions for a job through the REST API/Python SDK?

chrishartsock — Tue, 29 Sep 2020 20:30:16 GMT

Does anything special have to be done to enable logging into the splunkd_rest_access.log? I cannot find it. I have searched the _internal index as well as looked in /opt/splunk/var/log/splunk/ on our search head.
Thanks

Re: How to change permissions for a job through the REST API/Python SDK?

adauria_splunk — Tue, 17 Jul 2018 20:51:28 GMT

Sorry, splunkd_access will show you the REST calls

Re: How to change permissions for a job through the REST API/Python SDK?

sloshburch — Wed, 18 Jul 2018 13:19:12 GMT

I think the answer is at EAI response data cause there's a sharing parameter. Other than that, I thought it was possible to change permissions but done in the same way as any other Knowledge Object and not specific to searches...if that helps.

Re: How to change permissions for a job through the REST API/Python SDK?

chrishartsock — Wed, 18 Jul 2018 18:12:02 GMT

You and @SloshBurch both hit it. I was able to hit https://myserver:8089/services/search/jobs/search_id/acl with a payload of:
perms.read: *
sharing: global

That seemed to do the trick.

Thanks!