topic Re: REST API to Modify ES Correlation Search in Splunk Enterprise Security

REST API to Modify ES Correlation Search

cwo1010 — Wed, 30 Sep 2020 18:19:05 GMT

Hello,

I am trying to use Splunk's REST API in order to change portions of existing correlation searches created within Enterprise Security. For this test, I created a correlation search called chris_test. It has a description of "Test correlation search". I would like to modify its description to be "AAA". I try to do this as follows:

curl -k -u chris https://essplunk.company.com:8089/servicesNS/chris/SplunkEnterpriseSecuritySuite/saved/searches/Threat%20-%20chris_test%20-%20Rule -d description="EEE" > chris_test.txt

I also tried with:

-X POST -d description="EEE"

In both cases, it doesn't seem to make the update to the correlation search. Can someone help me to better understand what I am doing wrong? Long-term, I'd like to be able to use REST API to update the Next Steps of a notable Adaptive Response via something like:

-d action.notable.param.next_steps="DEMO"

Re: REST API to Modify ES Correlation Search

richgalloway — Wed, 30 Sep 2020 18:16:21 GMT

Have you tried URL-encoding the search name?

Re: REST API to Modify ES Correlation Search

cwo1010 — Wed, 30 Sep 2020 18:19:41 GMT

Whoops. It was URL encoded but Splunk Answers converted it back out. Guess I should have stuck that URL into a code block.

Re: REST API to Modify ES Correlation Search

jnussbaum_splun — Fri, 02 Oct 2020 16:22:07 GMT

Hi, could the issue be related to the Namespace? I see "chris" is specified in your curl, which would create/modify the object in $SPLUNK_HOME/etc/users/chris/<app>/local/savedsearches.conf, however the object you might be hoping to modify might exist in $SPLUNK_HOME/etc/apps/<app>/local/savedsearches.conf, so if you try replacing "chris" in your REST call with "nobody" - that may address the right object.

Hope this helps.

Re: REST API to Modify ES Correlation Search

cwo1010 — Fri, 02 Oct 2020 17:26:58 GMT

Replacing the username with "nobody" correctly converted the REST API action from a "create new search" action into a "modify an existing search" action.