topic ITSI REST API delete : Can't manage to delete deep dives in Splunk ITSI

ITSI REST API delete : Can't manage to delete deep dives

jwillaime — Thu, 05 Dec 2019 08:33:11 GMT

Hello,

I am trying to create and delete some deep dives view via the API.

While creating them is mostly done correctly (although they do not appear in the web GUI), I have issues deletting them.

Following are the cURL commands done to try to delete:

curl -k -u admin:pass  -X GET https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/deep_dive?filter='\{"title":"Test+Email2019-12-03+14:52:30.978203"\}'\&fields='_key';

Reponse:
[{"object_type": "deep_dive", "_key": "26acc2cf-15d4-11ea-812f-28924a399516"}]

Deletion command:

curl -k -u admin:pass  -X DELETE https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/deep_dive?filter='\{"title":"Test+Email2019-12-03+14:52:30.978203"\}'\&fields='_key';

No response

When I ask again for the same deepdice, I get the following:

curl -k -u admin:pass  -X GET https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/deep_dive?filter='\{"title":"Test+Email2019-12-03+14:52:30.978203"\}'\&fields='_key';

Reponse:
[{"object_type": "deep_dive", "_key": "26acc2cf-15d4-11ea-812f-28924a399516"}]

I would have thought that this last command would have given me a "element not found" or an empty list, but this is not the case.
The same thing happens even when using no filter, to delete all deep dives.

Am I missing something? Am I doing something wrong? Or is it a bug?

Thank you in advance.

Re: ITSI REST API delete : Can't manage to delete deep dives

esnyder_splunk — Wed, 30 Sep 2020 03:16:07 GMT

Try deleting the deep dive using the deep dive key in the URL. For example, “itoa_interface/deep_dive/DEEP_DIVE_KEY” instead of what you're currently doing, which is a query param.

Re: ITSI REST API delete : Can't manage to delete deep dives

jwillaime — Tue, 10 Dec 2019 07:35:45 GMT

Thanks for the help! That method works, but I still wonder if the previous method isn't bugged or something.

If you have a look at the documentation,
(https://docs.splunk.com/Documentation/ITSI/4.4.0/RESTAPI/ITSIRESTAPIreference#ITOA_Interface)
The example they give is the following:

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity?fields='title''&'filter='\{"title":"bar"\}' -X DELETE

Which is very similar to what I was trying to do.