Alerting

Python code please to modify alert permissions (owner, app and sharing) using splunklib SDK ?

dhiren051
New Member

Created splunk search and alert using splunklib.client python module but not able to find a way to modify alert owner, app and sharing parameters.please help with sample python code.

Tags (1)
0 Karma

harimadambi
Loves-to-Learn

import requests

data = {
'owner' : '<owner>',
'sharing' : '<app/global/system>',
'perms.read' : '*',
'perms.write' : 'admin,power'
}

url = 'https://<hostname>:8089/services/apps/local/test_app/acl'
response = requests.post(url, data=data, verify=False, auth=('admin', '<password>'))

 

0 Karma

damien_chillet
Builder

Managed to play with search permissions with the following sample:

import urllib

url = 'http://admin:changeme@localhost:8089/servicesNS/nobody/poc/saved/searches/some_search/acl'
data = urllib.urlencode({'sharing': 'global', 'owner': 'admin'})

urllib.urlopen(url, data)
0 Karma

dhiren051
New Member

I tried that link but got error 404 - my last 3 updated lines are:

url ="/servicesNS/nobody/system/{0}/acl".format(my_saved_search_name)

Note: since i created alert via splunklib , it got created with -- owner=nobody, app=system and sharing=global

params: {'sharing':'app'}
sendrequest (params, server, url)

Also, I tried java code example from below link, but not sure how do i use kwargs here in python :
https://answers.splunk.com/answers/143030/sharing-an-object-to-an-app-and-modifying-its-permission-u...

tried other several links from this blog - able to ran few of it in python but don't see any change in splunk UI.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...