Splunk IT Service Intelligence

How do I list ITSI correlation searches in json format?

bondmar30
Engager

When I use the REST api with the endpoint /servicesNS/nobody/SA-ITOA/event_management_interface/correlation_search all that I get back is []. When I add /count on the end of the endpoint I get a count of 40. How do I get to the actual correlation searches and retrieve them in .json format.

Trying to do some source code control. Has anyone done that as well?

Thanks,

Mark Bond

shandr
Path Finder

Thanks for your tip how we can use /count.

Try this technique if you want to extract the details of your Correlation Searches:
https://community.splunk.com/t5/Splunk-IT-Service-Intelligence/What-is-the-correct-REST-endpoint-to-...

 

0 Karma

esnyder_splunk
Splunk Employee
Splunk Employee

Hi guys, many of the endpoints are indeed broken and need validated. I believe that one is partially broken due to permissions we introduced. Our team is working on swaggerizing the ITSI API docs but until then we're at a bit of a loss. I'll get someone to review that one above and get back to you.

0 Karma

apka
Engager

I experience the same behavior with ITSI 4.01, related ITSI REST interface is not working as documented

0 Karma

PowerPacked
Builder

Hi @bondmar30

I gave it a try in my environment, it shows the same empty list.

I feel like many of the endpoints which are listed in the ITSI REST API doc are broken & not working as expected.

Have a look at this query by me.
https://answers.splunk.com/answers/668250/create-new-itsi-glass-table-through-rest-api-call

Splunk should do some kind of action untill next patch as these are limiting the power of ITSI.
Please try to raise a ticket with splunk if possible.

Thanks

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...