topic Re: Difference between Splunk rest api services and servicesNS? in Getting Data In

Difference between Splunk rest api services and servicesNS?

Vinesh93 — Mon, 30 Mar 2020 11:39:53 GMT

What is the difference between services and servicesNS in splunk rest api. Can someone explain it in detail?
Thanks in advance.

Re: Difference between Splunk rest api services and servicesNS?

richgalloway — Mon, 30 Mar 2020 12:34:36 GMT

servicesNS limits its scope to the specified namespace (username and app). It can apply to all namespaces by specifying - as the user and app names.

Re: Difference between Splunk rest api services and servicesNS?

jkat54 — Mon, 30 Mar 2020 12:44:43 GMT

I agree with Rich, please see https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTUM/RESTusing for more details. There is a "NAMESPACE" section.

Re: Difference between Splunk rest api services and servicesNS?

bayuste — Sun, 21 Nov 2021 15:36:03 GMT

I disagree. Reading Rich’s answer would lead you to believe that “| rest /servicesNS” is more restrictive than “| rest /services” by limiting the scope to the specified namespace. In fact, it is the other way around.

Or, more precisely, “| rest /services” is equivalent to “| rest /servicesNS/<currentUser>/<defaultApp>”, which implicitly limits the results to what is visible from the current user running in the default app context, which is usually the search app.

We can expand the namespace to include more results by converting the call to “| rest /servicesNS/-/-“, or we can change the namespace to an explicit user/app context with “| rest /servicesNS/<arbitraryUser>/<arbitraryApp>”.

It is a subtle but important difference. For some global system-wide resources, the results will be the same from every user/app context. In those cases, the call is usually shortened from “| rest /servicesNS/-/-” to “| rest /services”.

So, every time I see “| rest /services”, I translate that in my head to be “| rest /servicesNS/<currentUser>/<defaultApp>”