How to get a list of all Knowledge objects owned by a user in SplunkCloud via APIs ?

[arvind_Sugajeev]

Hi,

We needed to get a list of all the knowledge objects owned by a user in our SplunkCloud instance via APIs.

I have access to SplunkCloud ACS and am able to get a list of all users but it does not have details of the knowledge objects owned by the user.

Is it possible to get this data via ACS ? How can i get this data ?

Details of our SplunkCloud instance
Version: 9.1.2308.203
Experience: Victoria

[richgalloway]

There is no one API that will return all of the KOs owned by a given user.  You will have to combine multiple API results to get the full list.

| rest /services/saved/searches ``` Searches, reports, alerts ```
| rest /services/data/ui/views ``` Dashboards ```
| rest /services/data/macros ``` Macros ```
| rest /services/data/lookup-table-files ``` Lookup files ```
| rest /services/saved/eventtypes ``` Eventtypes ```

Those are some of the more common ones.  See other available API endpoints using

| rest /services/data

or

| rest /services/saved

[arvind_Sugajeev]

Hi @richgalloway 

Got it. what is the "rest" that is mentioned in your answer ? is it 

https://<deployment-name>.splunkcloud.com:8089

? if yes, then we have not opened port 8089 for our Splunkcloud instance, is it necessary to open this port to be able to use these API's ?

I have access to SplunkCloud ACS and am able to get the users list using it

https://admin.splunk.com/{stack}/adminconfig/v2/

P.S. I am new to API's and Splunk so apologies incase these are basic Splunk knowledge. Also, thanks for the quick reply 👍🏼

[richgalloway]

The "rest" in my answer is an SPL command.  The same REST endpoint can be accessed via port 8089 after the port is enabled.

ACS will not get you all of the KOs owned by a user.