Getting Data In

REST API with namespace?

Mick
Splunk Employee
Splunk Employee

I have a Search Macro in my Splunk application. I would like to invoke this Search Macro via REST API. To do that, I specify the Namespace in my HTTPRequest. However, the Splunk Server returns an error and indicates that Search Macro is not defined.

The HTTPRequest:

POST https://splunkserver.local:8089/services/search/jobs   
namespace = MyApp
search = search `MyMarco(foo1,01/13/2010:00:00:00,01/16/2010:00:00:00)`

If I change the permission of the Search Macro to Global and don't set the Namespace, it works as expected.

Thus, my question is how to set the namespace? According to my understanding on the namespace setting in the REST API, this should work. Do you have any example of the REST API with namespace?

Tags (4)
1 Solution

Johnvey
Contributor

The proper way to post a search job to a specific namespace is as follows:

https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

The difference between this URI and the original is that the root path segment:

/servicesNS/ vs /services/

which switches the server into namespace-aware mode. In your example, replace TARGET_NAMESPACE with MyApp, and YOUR_USERNAME with whatever identity you want to own the search job. The namespace POST parameter is not used.

Also, the search macro you define must be accessible by YOUR_USERNAME, so if you want to share this search job with others, make sure that the search macro is shared within the app. If this is to a completely private search, then just ensure that the search macro is owned by the same user as YOUR_USERNAME.

View solution in original post

Johnvey
Contributor

The proper way to post a search job to a specific namespace is as follows:

https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

The difference between this URI and the original is that the root path segment:

/servicesNS/ vs /services/

which switches the server into namespace-aware mode. In your example, replace TARGET_NAMESPACE with MyApp, and YOUR_USERNAME with whatever identity you want to own the search job. The namespace POST parameter is not used.

Also, the search macro you define must be accessible by YOUR_USERNAME, so if you want to share this search job with others, make sure that the search macro is shared within the app. If this is to a completely private search, then just ensure that the search macro is owned by the same user as YOUR_USERNAME.

View solution in original post

skawasaki_splun
Splunk Employee
Splunk Employee

So does the namespace parameter in GET or POST just not work or doesn't do what you expect it to do?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!