Updating Entities using ITSI REST API?

fidrildi — Tue, 17 Jan 2023 19:29:02 GMT

Hiya,
I am trying to use the ITSI REST API to update entities in my splunk development.

I am able to create entities and overwrite pre existing entities which have the same `_key` value.

But I want to just update an entity without overwriting/deleting any data.
So say I have an entity with 2 info fields:
"cpu_cores = 4"
"memory = 32"
and I just want to update the "cpu_cores" field to be "cpu_cores = 8" and leave the "memory" field the same, but whenever I execute the post request it overwrites the info fields and deletes the "memory" Field.

Below is the Endpoint I am using and the JSON object to update the entity:

Endpoint
https://<my_ip>:8089/servicesNS/nobody/itsi/itoa_interface/entity/bulk_update/?is_partial_data=1

JSON Object

[ { "_key":"aa_entity_1", "title": "aa entity 1", "object_type": "entity", "description": "Just a test", "informational": { "fields": [ "cpu_cores" ], "values": [ "8" ] }, "cpu_cores": [ "8" ] } ]

This JSON creates the entity fine, and what I understand from the documentation is that the "is_partial_data=1" should mean that it will only update data and not remove any, I have looked around and tried different things with the "is_partial_data=1". I've tried putting it into the JSON Object as "is_partial_data":true,
In the endpoint I saw somewhere that the "/" shouldn't be present before the "?is_partial_data=1", but this didnt work either.

Any help would be appreciated.

Addtional Info:

Splunk Enterprise: 9.0.3
ITSI Version: 4.13.2
Using Postman to do post request

Re: Updating Entities using ITSI REST API?

srauhala_splunk — Thu, 02 Feb 2023 23:16:19 GMT

Hi!

What is not working for you the "/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1" endpoint? What was the response?

This works for me on SE 9.0.3

curl -k -u user:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1 -H "Content-Type: application json" -X POST -d '[{"_key":"entity_guid","cpu":["56"]}]'

Note that the payload needs to be a JSON list.

topic Updating Entities using ITSI REST API? in Splunk ITSI

Updating Entities using ITSI REST API?

Re: Updating Entities using ITSI REST API?