Archive

Python code please to modify alert permissions (owner, app and sharing) using splunklib SDK ?

dhiren051
New Member

Created splunk search and alert using splunklib.client python module but not able to find a way to modify alert owner, app and sharing parameters.please help with sample python code.

Tags (1)
0 Karma

harimadambi
Loves-to-Learn

import requests

data = {
'owner' : '<owner>',
'sharing' : '<app/global/system>',
'perms.read' : '*',
'perms.write' : 'admin,power'
}

url = 'https://<hostname>:8089/services/apps/local/test_app/acl'
response = requests.post(url, data=data, verify=False, auth=('admin', '<password>'))

 

0 Karma

damien_chillet
Builder

Managed to play with search permissions with the following sample:

import urllib

url = 'http://admin:changeme@localhost:8089/servicesNS/nobody/poc/saved/searches/some_search/acl'
data = urllib.urlencode({'sharing': 'global', 'owner': 'admin'})

urllib.urlopen(url, data)
0 Karma

dhiren051
New Member

I tried that link but got error 404 - my last 3 updated lines are:

url ="/servicesNS/nobody/system/{0}/acl".format(my_saved_search_name)

Note: since i created alert via splunklib , it got created with -- owner=nobody, app=system and sharing=global

params: {'sharing':'app'}
sendrequest (params, server, url)

Also, I tried java code example from below link, but not sure how do i use kwargs here in python :
https://answers.splunk.com/answers/143030/sharing-an-object-to-an-app-and-modifying-its-permission-u...

tried other several links from this blog - able to ran few of it in python but don't see any change in splunk UI.

0 Karma

somesoni2
Revered Legend
0 Karma