topic Re: Splunk ES 8.2 API note management in Splunk Enterprise Security

Splunk ES 8.2 API note management

Dima — Sun, 26 Oct 2025 16:07:44 GMT

Hello,

Up until Splunk ES 8.1 Splunk ES has an option to update notable event using following API:

https://help.splunk.com/en/splunk-enterprise-security-8/rest-api-reference/8.0/notable-event-endpoints/notable-event-api-reference

Starting from Splunk ES 8.1 this API is not present any more.

In Splunk ES 8.2 there is a new API 's:

https://help.splunk.com/en/splunk-enterprise-security-8/api-reference/8.2/splunk-enterprise-security-api-reference/investigation/public_v2_get_notes_from_investigation

and

https://help.splunk.com/en/splunk-enterprise-security-8/api-reference/8.2/splunk-enterprise-security-api-reference/investigation/public_v2_update_note_in_investigation

Those API are suppose to support updating notes( comment in old Splunk ES versions ) as part of findings(notable event in old Splunk ES versions).

Apparently both of the API works only with investigation and not with finding - got error :

{

"code": "MC_01202",

"message": "No investigation found mapped to this display id: 0f17658c-9a6c-4de1-9945-b926a3f89c92@@notable",

"request_id": "d4df853d-a45f-4336-ab34-a4160e78705b"

}

Any solution for that ?

Can I still use notable event API from here :https://help.splunk.com/en/splunk-enterprise-security-8/rest-api-reference/8.0/notable-event-endpoints/notable-event-api-reference ?

Any help will be appreciated .

Re: Splunk ES 8.2 API note management

livehybrid — Mon, 27 Oct 2025 10:43:37 GMT

Hi @Dima

Does this work?

curl --request POST \ --url https://<yourSplunkServer>:8089/servicesNS/nobody/missioncontrol/public/v2/investigations/0f17658c-9a6c-4de1-9945-b926a3f89c92@@notable@@0f17658c9a6c4de19945b926a3f89c92/notes \ --header 'Accept: application/json' \ --header 'Authorization: <yourAuthToken>' \ --header 'Content-Type: application/json' \ --data '{ "title": "Note Title", "content": "Note content", "type": "Task" }'

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk ES 8.2 API note management

Dima — Tue, 28 Oct 2025 08:35:40 GMT

Hi @livehybrid and thank you for an answer.

The example you provided doesn't work :

request :
curl --location 'https://<mysplunk>:8089/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \
--data '{
"title": "Test finding4 for ES 8.2 - new note 8",
"content": "Comment for Test finding4 for ES 8.2 - via new API",
"type": "Task"

response:

{
"code": "MC_01202",
"message": "No investigation found mapped to this display id: 6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde",
"request_id": "b7e6edd4-498e-45f6-a344-96086203768e"
}

The example that worked for me :

request 2

curl --location 'https://<mysplunk>/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes?notable_time=-3m' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \
--data '{
"title": "Test finding4 for ES 8.2 - new note 16",
"content": "Comment for Test finding4 for ES 8.2 - via new API "
}'

response 2:

{
"id": "e258bd11-5e59-491a-b070-5d5d1af7cedd",
"create_time": 1761639950.3005178,
"update_time": 1761639950.3005178,
"title": "Test finding4 for ES 8.2 - new note 16",
"content": "Comment for Test finding4 for ES 8.2 - via new API ",
"author": {
"username": "developer"
},
"ai_generated": false,
"files": [],
"last_edited_by": null,
"response_plan_info": null,
"source": null,
"source_type": "Incident",
"incident_id": null,
"notable_id": "6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde"
}

The note is created correctly and can be seen in UI.

Re: Splunk ES 8.2 API note management

livehybrid — Tue, 28 Oct 2025 11:19:07 GMT

Ah great news, so to confirm for anyone else trying this, the notable_time param is required when creating a note?? I didnt see this in the docs - I'll enquire as to whether the docs arent correct or its a bug that the notable_time must be passed to create a note.

curl --location 'https://<mysplunk>/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes?notable_time=-3m' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \ --data '{ "title": "Test finding4 for ES 8.2 - new note 16", "content": "Comment for Test finding4 for ES 8.2 - via new API " }'

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk ES 8.2 API note management

Dima — Tue, 28 Oct 2025 13:17:30 GMT

This specific API is working fine, yes.

But the problem comes when you try to get notes or update specific note.

The response in most cases will be :

{

"code": "MC_01202",

"message": "No investigation found mapped to this display id: 6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde",

"request_id": "3d497390-1472-41d5-b702-19cf60750d60"

}

I suspect the the reason is following .

When we are looking at response from my example we can see following :

"source_type": "Incident",

But when we are looking on documentation example here :

https://help.splunk.com/en/splunk-enterprise-security-8/api-reference/8.2/splunk-enterprise-security-api-reference/investigation/public_v2_create_note_in_investigation

we see "source_type": "Task"

INHO this is a bug :

1 . "type": "Task" in request is not documented and has no affect

2. Apparently Splunk considered new note connected to an investigation and not to the finding and that't why I see an error for any other note-related API

Re: Splunk ES 8.2 API note management

Dima — Wed, 26 Nov 2025 08:36:46 GMT

Apparently it is possible to handle note ,that was created before under findings .

An example:

curl --location 'https://<splunk>:8089/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes/84db8262-c447-4a90-bbc1-96f8d5b2a1d2' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer {{sessionKey}}' \
--data '{
"title": "Test finding4 for ES 8.2 - new note 19 - updated ",
"content": "Comment for Test finding4 for ES 8.2 - via new API"
}'

In this example the first id in the url is finding id and the second one is note id.