REST API with namespace?

[Mick]

I have a Search Macro in my Splunk application. I would like to invoke this Search Macro via REST API. To do that, I specify the Namespace in my HTTPRequest. However, the Splunk Server returns an error and indicates that Search Macro is not defined.

The HTTPRequest:

POST https://splunkserver.local:8089/services/search/jobs   
namespace = MyApp
search = search `MyMarco(foo1,01/13/2010:00:00:00,01/16/2010:00:00:00)`

If I change the permission of the Search Macro to Global and don't set the Namespace, it works as expected.

Thus, my question is how to set the namespace? According to my understanding on the namespace setting in the REST API, this should work. Do you have any example of the REST API with namespace?

[Johnvey · Accepted solution]

The proper way to post a search job to a specific namespace is as follows:

https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

The difference between this URI and the original is that the root path segment:

/servicesNS/ vs /services/

which switches the server into namespace-aware mode. In your example, replace TARGET_NAMESPACE with MyApp, and YOUR_USERNAME with whatever identity you want to own the search job. The namespace POST parameter is not used.

Also, the search macro you define must be accessible by YOUR_USERNAME, so if you want to share this search job with others, make sure that the search macro is shared within the app. If this is to a completely private search, then just ensure that the search macro is owned by the same user as YOUR_USERNAME.

[skawasaki_splun]

So does the namespace parameter in GET or POST just not work or doesn't do what you expect it to do?