Security
Highlighted

Can eventtypes for specific users be disabled via the REST API?

New Member

I'd like to disable eventtypes via the REST API. These eventtypes could be owned by a variety of users, but I want to make my API calls with a single user. According to the Splunk API docs, the correct way to do this is to POST to /services/saved/eventtypes/ with disabled=1. This works fine when making the API call as the user that owns the event type, however, if I make the same call as a different user, it creates a disabled duplicate eventtype with the same name, owned by the user that made the API call. The original eventtype remains enabled.

So, when updating/disabling an eventtype via the API, is there any way to specify the owner of that eventtype in the POST? Or is there a way to ensure that the API call will operate on the existing eventtype regardless of the owner, instead of creating a new eventtype?

0 Karma
Highlighted

Re: Can eventtypes for specific users be disabled via the REST API?

SplunkTrust
SplunkTrust

Try this REST API endpoint for updating user specific event types (example with curl)

curl -k -u admin:pass https://yoursplunkserver:mgmtport/servicesNS/usernameHere/appnameHere/saved/eventtypes/eventtypename... -d disabled=1

Update the admin, pass, yoursplunkserver, mgmtport, usernameHere, appnameHere and eventtypenameHere per your environment.

Update

Try this. Seems to be working for me.

curl -X POST -k -u admin:pass https://yoursplunkserver:mgmtport/servicesNS/nobody/appnameHere/saved/eventtypes/eventtypenameHere/d...

View solution in original post

Highlighted

Re: Can eventtypes for specific users be disabled via the REST API?

New Member

Thanks for the answer somesoni2, however that doesn't appear to work. The API call succeeds, but it still creates a duplicate eventtype. The duplicate is owned by the user provided in the URL at instead of the API user like before, but it's still not updating the existing eventtype.

0 Karma
Highlighted

Re: Can eventtypes for specific users be disabled via the REST API?

SplunkTrust
SplunkTrust

Give the updated answer a try.

0 Karma
Highlighted

Re: Can eventtypes for specific users be disabled via the REST API?

New Member

That works for me. Thank you!

0 Karma