Splunk Dev

How to modify lookup ACL via custom REST in Python?

GindiKhangura
Explorer

(Although this example will use Splunk's Lookup Editor app, it applies to custom REST commands in general.)

I am using the Lookup Editor provided by Splunk from SplunkBase (authored by @LukeMurphey) and am saving the lookups with the user in context, which saves it as a private user-scoped artifact.

I would like to make it globally shared while retaining the lookup's ownership information, so I attempt the following after the rest call that saves the lookup:

 

# Set ACL to make lookup globally shared
url = '/servicesNS/%s/%s/data/lookup-table-files/%s/acl' % (owner, namespace, lookup_file)
postargs = {
    'owner': owner, 
    'sharing': 'global'
}

rest.simpleRequest(url, postargs=postargs, sessionKey=key, raiseAllErrors=True)

 

When using the lookup editor as an admin, it will work fine as the admin has the capabilities to make such modifications; however, users are not able to do so and the call fails.

How can I programmatically make this REST call as an admin? I am hoping that as the script is on the server-side, I won't have to authenticate as an admin as I imagine that would require having to store credentials, which would be tricky as we have several clusters.

I have also tried making the REST call using the Splunk binary as mentioned in this Answer, but it had no effect.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...