How do I list ITSI correlation searches in json format?

[bondmar30]

When I use the REST api with the endpoint /servicesNS/nobody/SA-ITOA/event_management_interface/correlation_search all that I get back is []. When I add /count on the end of the endpoint I get a count of 40. How do I get to the actual correlation searches and retrieve them in .json format.

Trying to do some source code control. Has anyone done that as well?

Thanks,

Mark Bond

[shandr]

Thanks for your tip how we can use /count.

Try this technique if you want to extract the details of your Correlation Searches:
https://community.splunk.com/t5/Splunk-IT-Service-Intelligence/What-is-the-correct-REST-endpoint-to-...

[esnyder_splunk]

Hi guys, many of the endpoints are indeed broken and need validated. I believe that one is partially broken due to permissions we introduced. Our team is working on swaggerizing the ITSI API docs but until then we're at a bit of a loss. I'll get someone to review that one above and get back to you.

[apka]

I experience the same behavior with ITSI 4.01, related ITSI REST interface is not working as documented

[PowerPacked]

Hi @bondmar30

I gave it a try in my environment, it shows the same empty list.

I feel like many of the endpoints which are listed in the ITSI REST API doc are broken & not working as expected.

Have a look at this query by me.
https://answers.splunk.com/answers/668250/create-new-itsi-glass-table-through-rest-api-call

Splunk should do some kind of action untill next patch as these are limiting the power of ITSI.
Please try to raise a ticket with splunk if possible.

Thanks