Python code please to modify alert permissions (owner, app and sharing) using splunklib SDK ?

New Member

Created splunk search and alert using splunklib.client python module but not able to find a way to modify alert owner, app and sharing parameters.please help with sample python code.

Tags (1)
0 Karma


import requests

data = {
'owner' : '<owner>',
'sharing' : '<app/global/system>',
'' : '*',
'perms.write' : 'admin,power'

url = 'https://<hostname>:8089/services/apps/local/test_app/acl'
response =, data=data, verify=False, auth=('admin', '<password>'))


0 Karma


Managed to play with search permissions with the following sample:

import urllib

url = 'http://admin:changeme@localhost:8089/servicesNS/nobody/poc/saved/searches/some_search/acl'
data = urllib.urlencode({'sharing': 'global', 'owner': 'admin'})

urllib.urlopen(url, data)
0 Karma

New Member

I tried that link but got error 404 - my last 3 updated lines are:

url ="/servicesNS/nobody/system/{0}/acl".format(my_saved_search_name)

Note: since i created alert via splunklib , it got created with -- owner=nobody, app=system and sharing=global

params: {'sharing':'app'}
sendrequest (params, server, url)

Also, I tried java code example from below link, but not sure how do i use kwargs here in python :

tried other several links from this blog - able to ran few of it in python but don't see any change in splunk UI.

0 Karma

Revered Legend
0 Karma