Splunk Cloud Platform

How can I modify dashboard view App & owner via REST API?

imsidrai
Explorer

How can i modify or update owner & app context for  dashboard view/panel via REST API call ?

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use a GET call to obtain the dashboard's XML definition.  Modify the definition as required then use a PUT call to update the dashboard.  See https://docs.splunk.com/Documentation/Splunk/9.1.0/RESTREF/RESTknowledge#data.2Fui.2Fviews.2F.7Bname...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use a GET call to obtain the dashboard's XML definition.  Modify the definition as required then use a PUT call to update the dashboard.  See https://docs.splunk.com/Documentation/Splunk/9.1.0/RESTREF/RESTknowledge#data.2Fui.2Fviews.2F.7Bname...

---
If this reply helps you, Karma would be appreciated.

imsidrai
Explorer

@richgalloway 
so this operation can not be done in bulk.. i have 100 of views (owned by a user who isnt part of organization)  some of which i want to delete and reassign some to another app and user

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"bulk" was not part of the OP.  Consider writing a script that performs the necessary operations on all 100 objects for you.

---
If this reply helps you, Karma would be appreciated.
0 Karma

imsidrai
Explorer

so if i do like below in my code , that should work  and change app & user context or for views the endpoint is different ?

 

dashboard_name = "view_name"

dashboard_xml_data = get_user_accounts_dashboard_xml(main_query_user_accounts, addon_query_user_accounts_sum)

data = {'output_mode': 'json',

        'owner': 'test_user',

        'app_name: 'test_app'

        }

response = requests.post( splunk_server + '/servicesNS/' + app_author + '/' + app_name + '/data/ui/views/' + view_name +"/acl", data=data,

                             auth=(user, password), verify=False)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

At a high level, that appears to be a good approach.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...