Reporting

Rest call SPL to change ownership of a saved search

rajim
Path Finder

I know the rest api command to change the ownership of a saved search. Below is the command. I want to know corresponding SPL so that I can issue this query from Splunk web interface and change the ownership.

/servicesNS/user01/search/saved/searches/$_SAVED_SEARCH_NAME_$/acl -d owner=user02 -d sharing=$_SHARING_VALUE_$

Can anyone please help me here?

Labels (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change

View solution in original post

harsmarvania57
Ultra Champion

Hi,

You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change

rajim
Path Finder

Thank you for the clarification and the links.

0 Karma

harsmarvania57
Ultra Champion

Welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...