Getting Data In

REST API with namespace?

Mick
Splunk Employee
Splunk Employee

I have a Search Macro in my Splunk application. I would like to invoke this Search Macro via REST API. To do that, I specify the Namespace in my HTTPRequest. However, the Splunk Server returns an error and indicates that Search Macro is not defined.

The HTTPRequest:

POST https://splunkserver.local:8089/services/search/jobs   
namespace = MyApp
search = search `MyMarco(foo1,01/13/2010:00:00:00,01/16/2010:00:00:00)`

If I change the permission of the Search Macro to Global and don't set the Namespace, it works as expected.

Thus, my question is how to set the namespace? According to my understanding on the namespace setting in the REST API, this should work. Do you have any example of the REST API with namespace?

Tags (4)
1 Solution

Johnvey
Contributor

The proper way to post a search job to a specific namespace is as follows:

https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

The difference between this URI and the original is that the root path segment:

/servicesNS/ vs /services/

which switches the server into namespace-aware mode. In your example, replace TARGET_NAMESPACE with MyApp, and YOUR_USERNAME with whatever identity you want to own the search job. The namespace POST parameter is not used.

Also, the search macro you define must be accessible by YOUR_USERNAME, so if you want to share this search job with others, make sure that the search macro is shared within the app. If this is to a completely private search, then just ensure that the search macro is owned by the same user as YOUR_USERNAME.

View solution in original post

Johnvey
Contributor

The proper way to post a search job to a specific namespace is as follows:

https://splunkserver:8089/servicesNS/YOUR_USERNAME/TARGET_NAMESPACE/search/jobs

The difference between this URI and the original is that the root path segment:

/servicesNS/ vs /services/

which switches the server into namespace-aware mode. In your example, replace TARGET_NAMESPACE with MyApp, and YOUR_USERNAME with whatever identity you want to own the search job. The namespace POST parameter is not used.

Also, the search macro you define must be accessible by YOUR_USERNAME, so if you want to share this search job with others, make sure that the search macro is shared within the app. If this is to a completely private search, then just ensure that the search macro is owned by the same user as YOUR_USERNAME.

skawasaki_splun
Splunk Employee
Splunk Employee

So does the namespace parameter in GET or POST just not work or doesn't do what you expect it to do?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...