Getting Data In

How to create new MACRO using Rest api?

jadengoho
Builder

As of now i follow this code and it works perfectly :

  from splunklib.client import connect
  service = connect(username="admin", password="changeme", host="myhost", app="search")
  service.post('properties/macros/test', definition="test123")
  print service.get('properties/macros/test/definition')["body"]

I see it here https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html
But that code was to update ,

What if i want to add or delete a macro using the code ?

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @jadenhoho,

To create macro using Rest API, you can achieve like this

import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.post('properties/macros', __stanza="test")
service.post('properties/macros/test', definition="test123")
print service.get('properties/macros/test/definition')["body"]

I don't have idea about delete one.

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi @jadenhoho,

To create macro using Rest API, you can achieve like this

import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.post('properties/macros', __stanza="test")
service.post('properties/macros/test', definition="test123")
print service.get('properties/macros/test/definition')["body"]

I don't have idea about delete one.

0 Karma

jadengoho
Builder

Thanks for that it is helpfull ,
i already tried

  import splunklib.client as client
 service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('properties/macros/name')

But it only does disable the macro but not delete it fully,
is there any function that apply that ?

0 Karma

harsmarvania57
Ultra Champion

This one worked for me for deleting macro using REST API

import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('/servicesNS/nobody/search/admin/macros/test')
0 Karma

jadengoho
Builder

Thank you very much this code really help 🙂

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...