How to create new MACRO using Rest api?

[jadengoho]

As of now i follow this code and it works perfectly :

  from splunklib.client import connect
  service = connect(username="admin", password="changeme", host="myhost", app="search")
  service.post('properties/macros/test', definition="test123")
  print service.get('properties/macros/test/definition')["body"]

I see it here https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html
But that code was to update ,

What if i want to add or delete a macro using the code ?

[harsmarvania57 · Accepted solution]

Hi @jadenhoho,

To create macro using Rest API, you can achieve like this

import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.post('properties/macros', __stanza="test")
service.post('properties/macros/test', definition="test123")
print service.get('properties/macros/test/definition')["body"]

I don't have idea about delete one.

[jadengoho]

Thanks for that it is helpfull ,
i already tried

  import splunklib.client as client
 service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('properties/macros/name')

But it only does disable the macro but not delete it fully,
is there any function that apply that ?

[harsmarvania57]

This one worked for me for deleting macro using REST API

import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('/servicesNS/nobody/search/admin/macros/test')

[jadengoho]

Thank you very much this code really help 🙂