Other Usage

Splunk REST API query (possible issue with URL encoding)

tomapatan
Communicator

Hi Everyone,

I`m learning about the Splunk REST API and I`m experiencing some temperamental behaviour, for example I can fetch results using the query listed below from some reports, but it fails for others, example below:

 

curl -k -H "Authorization: Splunk myValidToken" https://myValidDomainName.splunkcloud.com:8089/services/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

 Response:

 

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Could not find object id=[LOOKUP] Active Directory Devices No2</msg>
  </messages>
</response>

 

The report name is correct.

Have you got any suggestions for me ?

Many thanks,

Toma

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer

Hi,

This occurs when the object you're referencing is not visible in the user's default context. You can reference the user/app context directly with:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/<user>/<app>/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

where <user> and <app> are the user name and app name, respectively. If you have read access to the object but don't know the owner or app, you can use hyphens as wildcards:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/-/-/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

View solution in original post

0 Karma

tscroggins
Influencer

Hi,

This occurs when the object you're referencing is not visible in the user's default context. You can reference the user/app context directly with:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/<user>/<app>/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

where <user> and <app> are the user name and app name, respectively. If you have read access to the object but don't know the owner or app, you can use hyphens as wildcards:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/-/-/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

0 Karma

tomapatan
Communicator

Worked like a charm, much appreciated.

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...