Splunk IT Service Intelligence

Updating Entities using ITSI REST API?

fidrildi
Loves-to-Learn Lots

Hiya, 
I am trying to use the ITSI REST API to update entities in my splunk development.

I am able to create entities and overwrite pre existing entities which have the same `_key` value. 

But I want to just update an entity without overwriting/deleting any data.
So say I have an entity with 2 info fields:
"cpu_cores = 4"
"memory = 32"
and I just want to update the "cpu_cores" field to be "cpu_cores = 8" and leave the "memory" field the same, but whenever I execute the post request it overwrites the info fields and deletes the "memory" Field.

Below is the Endpoint I am using and the JSON object to update the entity:

Endpoint
https://<my_ip>:8089/servicesNS/nobody/itsi/itoa_interface/entity/bulk_update/?is_partial_data=1

JSON Object

 

 

[
    {
        "_key":"aa_entity_1",
        "title": "aa entity 1",
        "object_type": "entity",
        "description": "Just a test",
        "informational": {
            "fields": [
                "cpu_cores"
            ],
            "values": [
                "8"
            ]
        },
        "cpu_cores": [
            "8"
        ]
    }
]

 

 

 

This JSON creates the entity fine, and what I understand from the documentation is that the "is_partial_data=1" should mean that it will only update data and not remove any, I have looked around and tried different things with the "is_partial_data=1". I've tried putting it into the  JSON Object as "is_partial_data":true,
In the endpoint I saw somewhere that the "/" shouldn't be present before the "?is_partial_data=1", but this didnt work either.

Any help would be appreciated.

Addtional Info:

Splunk Enterprise: 9.0.3
ITSI Version: 4.13.2
Using Postman to do post request

Labels (2)
Tags (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Hi! 

What is not working for you the "/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1" endpoint? What was the response? 

This works for me on SE 9.0.3 

curl -k -u user:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1 -H "Content-Type: application json" -X POST -d '[{"_key":"entity_guid","cpu":["56"]}]'

Note that the payload needs to be a JSON list. 

 

 

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...