Getting Data In

REST API with namespace?

Mick
Splunk Employee
Splunk Employee

I have a Search Macro in my Splunk application. I would like to invoke this Search Macro via REST API. To do that, I specify the Namespace in my HTTPRequest. However, the Splunk Server returns an error and indicates that Search Macro is not defined.

The HTTPRequest:

POST https://splunkserver.local:8089/services/search/jobs   
namespace = MyApp
search = search `MyMarco(foo1,01/13/2010:00:00:00,01/16/2010:00:00:00)`

If I change the permission of the Search Macro to Global and don't set the Namespace, it works as expected.

Thus, my question is how to set the namespace? According to my understanding on the namespace setting in the REST API, this should work. Do you have any example of the REST API with namespace?

Tags (4)
1 Solution

Johnvey
Contributor

The proper way to post a search job to a specific namespace is as follows:

https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

The difference between this URI and the original is that the root path segment:

/servicesNS/ vs /services/

which switches the server into namespace-aware mode. In your example, replace TARGET_NAMESPACE with MyApp, and YOUR_USERNAME with whatever identity you want to own the search job. The namespace POST parameter is not used.

Also, the search macro you define must be accessible by YOUR_USERNAME, so if you want to share this search job with others, make sure that the search macro is shared within the app. If this is to a completely private search, then just ensure that the search macro is owned by the same user as YOUR_USERNAME.

View solution in original post

Johnvey
Contributor

The proper way to post a search job to a specific namespace is as follows:

https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

The difference between this URI and the original is that the root path segment:

/servicesNS/ vs /services/

which switches the server into namespace-aware mode. In your example, replace TARGET_NAMESPACE with MyApp, and YOUR_USERNAME with whatever identity you want to own the search job. The namespace POST parameter is not used.

Also, the search macro you define must be accessible by YOUR_USERNAME, so if you want to share this search job with others, make sure that the search macro is shared within the app. If this is to a completely private search, then just ensure that the search macro is owned by the same user as YOUR_USERNAME.

skawasaki_splun
Splunk Employee
Splunk Employee

So does the namespace parameter in GET or POST just not work or doesn't do what you expect it to do?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...