Splunk ITSI

Create new ITSI Glass Table through - Rest API call

PowerPacked
Builder

Hi Guys

I would like to create new glass tables through Rest API calls - but am failing as am not able to pass proper arguments needed for POST action of API call of ITSI glass table.

for example:

    curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity -H "Content-Type: 
    application/json" -X POST -d '{"component": ["PerProcess"],"informational": {"fields": ["info"],"values": ["field"]},"_version": 
    "3.0.0","title": "PerProcess","object_type": "entity","_type":"entity","identifier": {"fields": ["component"],"values": 
    ["PerProcess"]}}' 

This above call creates a new Entity in ITSI through Rest API call which is given in this doc
http://docs.splunk.com/Documentation/ITSI/3.0.1/RESTAPI/ITSIRESTAPIreference

i would like to create a new Glass Table in this way.

Help is appreciated
Thanks

mitani
New Member

Here is how i managed to create glass tables via REST calls.

Method: POST
Endpoint: /servicesNS/nobody/SA-ITOA/itoa_interface/glass_table
JSON: {
"content": [

],
"acl": {
    "can_share_global": true,
    "sharing": "app",
    "perms": {
        "read": [
            "*"
        ],
        "write": [
            "*"
        ]
    },
    "can_write": true,
    "owner": "xxx",
    "can_share_app": true,
    "modifiable": true,
    "can_change_perms": true,
    "can_share_user": true
},
"identifying_name": "xxx",
"title": "xxx",
"_owner": "nobody",
"_user": "nobody"

}

Make sure to fill in owner, title, identifying_name and modify any true/false based on your needs.

Good luck!
,Here is how i managed to create glass tables via REST calls.

Method: POST
Endpoint: /servicesNS/nobody/SA-ITOA/itoa_interface/glass_table
JSON:
{
"content": [

],
"acl": {
    "can_share_global": true,
    "sharing": "app",
    "perms": {
        "read": [
            "*"
        ],
        "write": [
            "*"
        ]
    },
    "can_write": true,
    "owner": "xxx",
    "can_share_app": true,
    "modifiable": true,
    "can_change_perms": true,
    "can_share_user": true
},
"identifying_name": "xxx",
"title": "xxx",
"_owner": "nobody",
"_user": "nobody"

}

Make sure to fill in owner, title, identifying_name and modify any true/false based on your needs.

Good luck!

,Here is how i managed to create glass tables via REST calls.

Method: POST
Endpoint: /servicesNS/nobody/SA-ITOA/itoa_interface/glass_table
JSON: {
"content": [

],
"acl": {
    "can_share_global": true,
    "sharing": "app",
    "perms": {
        "read": [
            "*"
        ],
        "write": [
            "*"
        ]
    },
    "can_write": true,
    "owner": "xxx",
    "can_share_app": true,
    "modifiable": true,
    "can_change_perms": true,
    "can_share_user": true
},
"identifying_name": "xxx",
"title": "xxx",
"_owner": "nobody",
"_user": "nobody"

}

Make sure to fill in owner, title, identifying_name and modify any true/false based on your needs.

Good luck!

0 Karma

arowsell_splunk
Splunk Employee
Splunk Employee

Not sure the exact curl command being used but was able to create an empty Glass Table using the following on ITSI v4:

curl -k -u admin https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/glass_table -H "Content-Type:application/json" -X POST -d '{"_owner": "admin","title": "test_API_glass_table","description": "test_glass_table","object_type": "glass_table","latest": "now","latest_label": "now","svg_coordinates": {"viewdy": 0, "viewdx": 0}, "is_epoch": "false", "templateSwappableServiceIds":[]}'

Don't know if this helps.

hjauch_splunk
Splunk Employee
Splunk Employee

One of the engineers on the ITSI team tested out creating a glass table using the endpoint and it appears to be broken. We have filed a bug to fix this issue. Sorry for the inconvenience.

PowerPacked
Builder

Hi @hjauch

Thanks for the reply,

I was able to update, delete the glass table using the same end point, but am not sure why only create is not working.

if possible, please provide with a work around untill a new patch is released.

Thank you

0 Karma

hjauch_splunk
Splunk Employee
Splunk Employee

The workaround is to create the glass table through the UI until a fix can be made.

0 Karma

PowerPacked
Builder

Hi hjauch

This issue was not fixed & end point is not working in new and updated ITSI 4.0 version.

Please guys can you look and fix this issue at least in next release.

Thanks

0 Karma

hjauch_splunk
Splunk Employee
Splunk Employee

You are correct, the issue has not been fixed yet. It is issue # ITSI-918. Sorry about the inconvenience.

Some information on what you are trying to accomplish may be helpful. Are you trying to create an empty glass table or a glass table with widgets?

0 Karma

PowerPacked
Builder

Please, Can someone from Splunk answer this question

Thanks

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...