Splunk Dev

Update notable event with splunklib (splunk-sdk for python)

breid1313
Path Finder

Hi all,

I'm wondering if anyone has had success updating notable events using the Splunk SDK for Python (splunklib). I've seen a few examples of how to get it done with the splunk python package (for example https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-edit-notable-events-in-es-programatically.h...), but I'd prefer to leverage the Python SDK.

I've formatted the POST request every way I can think of, but I can't get a proper request to the server. I always get the error:

```

splunklib.binding.HTTPError: HTTP 400 Bad Request -- b'"ValueError: One of comment, newOwner, status, urgency is required."'

```

I am passing a `comment` argument, but it must be doing it incorrectly.

Labels (3)
Tags (2)
0 Karma

splunker_dave
New Member

A little late to the party here... I had the same issue when trying to post to Notables. I was able to solve it by structuring the calls this way:

 

data={

"ruleUIDs":"123456789" ,

"comment":"comment goes here",

}

Hope this helps.

0 Karma

kchamplin_splun
Splunk Employee
Splunk Employee

A curl based example is available here:

https://docs.splunk.com/Documentation/ES/latest/API/NotableEventAPIreference

I'd reference that doc and leave comments on the doc page if you still run into issues.

Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...