topic Splunk REST API query (possible issue with URL encoding) in Other Usage

Splunk REST API query (possible issue with URL encoding)

tomapatan — Thu, 06 Apr 2023 08:28:39 GMT

Hi Everyone,

I`m learning about the Splunk REST API and I`m experiencing some temperamental behaviour, for example I can fetch results using the query listed below from some reports, but it fails for others, example below:

curl -k -H "Authorization: Splunk myValidToken" https://myValidDomainName.splunkcloud.com:8089/services/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

Response:

<?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Could not find object id=[LOOKUP] Active Directory Devices No2</msg> </messages> </response>

The report name is correct.

Have you got any suggestions for me ?

Many thanks,

Toma

Re: Splunk REST API query (possible issue with URL encoding)

tscroggins — Thu, 06 Apr 2023 22:45:52 GMT

Hi,

This occurs when the object you're referencing is not visible in the user's default context. You can reference the user/app context directly with:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/<user>/<app>/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

where <user> and <app> are the user name and app name, respectively. If you have read access to the object but don't know the owner or app, you can use hyphens as wildcards:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/-/-/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

Re: Splunk REST API query (possible issue with URL encoding)

tomapatan — Tue, 11 Apr 2023 07:49:19 GMT

Worked like a charm, much appreciated.