Splunk Dev

Why is API change not updated in web page?

MScottFoley
Path Finder

I updated an alert description using the REST API (port 8089).  When I use the API to list the description it shows the updated description.  When I look at the alert using the web page (port 8000) it still has the old version.  There are multiple instances of Splunk and a load balancer, but I do not know the specifics.  I always use the same IP address to access Splunk.    

For the API access I use a token under my username.  Is my token the problem?  My user has enough rights to create and change alerts.  Although when I list all alerts using |rest/servicesNS/-/-/saved/searches I get a warning Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability

Thanks.  

Labels (1)
0 Karma

MScottFoley
Path Finder

It may be the way I am accessing Splunk through the API.  I am using my user since the API token is for my user.    $"{splunkBaseUrl}/servicesNS/{user}/search/saved/searches/";

There is documentation that says to use https://<host>:<mPort>/services/alerts/alert_actions.  I think I had tried that before and could not get it to work with the API token I was using at least.  

I will try using a different endpoint.

 

0 Karma

MScottFoley
Path Finder

Thanks Rich,

I thought it could be the cluster.  If I update the alert from one computer and then look at it from another (on a different network) it is updated on both.  Viewing the alert using the API does not show the change though.  It's like the API is changing and reading a local version of the alert.  I have asked internally about this problem too.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the Splunk instances are a Search Head cluster then changes made to one should be reflected in the others within a few minutes at most.  Sometimes, page caches can cause old data to be displayed.  Try holding down the shift key as you refresh the page.  If that doesn't help, clear your browser cache or use incognito mode.

You can use the splunk_server=local option to the rest command to suppress that warning.  Saved searches are only on the SH, anyway, so there's no need to send the request to the indexers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...