I've tried the /servicesNS/userid/-/data/ui/views
endpoint but maybe I'm not using it correctly. I have a known view owned by the user that does not show anywhere in the output from calling that endpoint.
curl -sku admin:password https://127.0.0.1:8089/servicesNS/userid/his_app/data/ui/views | grep known_view_name
The view I searched for is in the app, is shared at app level. If I run:
curl -sku admin:password https://127.0.0.1:8089/servicesNS/userid/his_app/data/ui/views/known_view_name
I get results. What am I missing?
I want a list of the view names (not the titles) for a particular user.
Thanks!
How about a splunk search with "| rest" (Please replace $username$ with a proper user name)
| rest splunk_server=local /servicesNS/-/-/data/ui/views
| table eai:acl.sharing eai:acl.owner id
| rename eai:acl.owner as owner, eai:acl.sharing AS sharing | search owner=$username$
How about a splunk search with "| rest" (Please replace $username$ with a proper user name)
| rest splunk_server=local /servicesNS/-/-/data/ui/views
| table eai:acl.sharing eai:acl.owner id
| rename eai:acl.owner as owner, eai:acl.sharing AS sharing | search owner=$username$
Yeah, that would work. Was hoping for a single script solution, but I can copy-pasta.
Add title
immediately after table in the second line of the search to get the search name.
Actually, throwing this on the command line works really well. I can feed it into a for loop. The end result being a batch ownership change script.
Aha. The user had too many views to fit in the default count returned. Final product, including new '?count=0' specifier.
curl -sku admin:password 'https://127.0.0.1:8089/servicesNS/user/app/data/ui/views?count=0' | grep '<id>' | grep app/data/ui/views/ | sed -e 's^.*/views/^^' | sed -e 's^</id>^^'
EDIT: It's imperfect. I see views owned by "nobody" in the returned list. Still trying to find the magix to return just the views owned by user. -sigh-