entitySelectLister entityPath have to be a saved search?

[hiddenkirby]

When using an entitySelectLister ... does the entityPath have to be a saved search name? or can i use a searchTemplate or something equiv.

[gkanapathy · Accepted solution]

It needs to be the virtual "path" of a Splunk object type or type. This can be a specific object, or the parent path (relative to the root of the services namespace). So for example saved/searches, saved/eventtypes, data/indexes. The path is the one you'd use to enumerate the object(s) under the REST API (relative to the namespace root again).

[hiddenkirby]

oh ok this is helpful... thank you 🙂

[hiddenkirby]

or maybe where i can find the entity "admin/distsearch-peer" .. maybe then i can try to backwards-translate some of this advanced xml.

[gkanapathy]

Closest is http://www.splunk.com/base/Documentation/4.1.2/Developer/ModuleReference#EntitySelectLister is the closest, and notes that entityPath should be a valid entity path such as saved/searches. http://www.splunk.com/base/Documentation/4.1.2/Developer/HowToUseListers#EntityLinkLister mentions use to access objects via REST endpoints. However, the REST management API (as opposed to the query API) is not currently published though it can be browsed on https://splunkhost:8089/services

[hiddenkirby]

is there any specific documentation?

[hiddenkirby]

how would one figure this out on his own? other than trying to interpret examples in search?