Splunk Dev

Update notable event with splunklib (splunk-sdk for python)

breid1313
Path Finder

Hi all,

I'm wondering if anyone has had success updating notable events using the Splunk SDK for Python (splunklib). I've seen a few examples of how to get it done with the splunk python package (for example https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-edit-notable-events-in-es-programatically.h...), but I'd prefer to leverage the Python SDK.

I've formatted the POST request every way I can think of, but I can't get a proper request to the server. I always get the error:

```

splunklib.binding.HTTPError: HTTP 400 Bad Request -- b'"ValueError: One of comment, newOwner, status, urgency is required."'

```

I am passing a `comment` argument, but it must be doing it incorrectly.

Labels (3)
Tags (2)
0 Karma

splunker_dave
New Member

A little late to the party here... I had the same issue when trying to post to Notables. I was able to solve it by structuring the calls this way:

 

data={

"ruleUIDs":"123456789" ,

"comment":"comment goes here",

}

Hope this helps.

0 Karma

kchamplin_splun
Splunk Employee
Splunk Employee

A curl based example is available here:

https://docs.splunk.com/Documentation/ES/latest/API/NotableEventAPIreference

I'd reference that doc and leave comments on the doc page if you still run into issues.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...