Difference between Splunk rest api services and servicesNS?

[Vinesh93]

What is the difference between services and servicesNS in splunk rest api. Can someone explain it in detail?
Thanks in advance.

[richgalloway]

servicesNS limits its scope to the specified namespace (username and app). It can apply to all namespaces by specifying - as the user and app names.

[jkat54]

I agree with Rich, please see https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTUM/RESTusing for more details. There is a "NAMESPACE" section.

[bayuste]

I disagree. Reading Rich’s answer would lead you to believe that “| rest /servicesNS” is more restrictive than “| rest /services” by limiting the scope to the specified namespace. In fact, it is the other way around.

Or, more precisely, “| rest /services” is equivalent to “| rest /servicesNS/<currentUser>/<defaultApp>”, which implicitly limits the results to what is visible from the current user running in the default app context, which is usually the search app.

We can expand the namespace to include more results by converting the call to “| rest /servicesNS/-/-“, or we can change the namespace to an explicit user/app context with “| rest /servicesNS/<arbitraryUser>/<arbitraryApp>”.

It is a subtle but important difference. For some global system-wide resources, the results will be the same from every user/app context. In those cases, the call is usually shortened from “| rest /servicesNS/-/-” to “| rest /services”.

So, every time I see “| rest /services”, I translate that in my head to be “| rest /servicesNS/<currentUser>/<defaultApp>”