Splunk ITSI

In Splunk IT Service Intelligence(ITSI), how do I create a new glass table through REST API call?

PowerPacked
Builder

Hi Guys,

I would like to create new glass tables through Rest API calls. But, I am failing as I'm not able to pass proper arguments needed for POST action of API call of ITSI glass table.

for example:

 curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity -H "Content-Type: 
     application/json" -X POST -d '{"component": ["PerProcess"],"informational": {"fields": ["info"],"values": ["field"]},"_version": 
     "3.0.0","title": "PerProcess","object_type": "entity","_type":"entity","identifier": {"fields": ["component"],"values": 
     ["PerProcess"]}}' 

This above call creates a new Entity in ITSI through Rest API call which is given in this doc:
http://docs.splunk.com/Documentation/ITSI/3.0.1/RESTAPI/ITSIRESTAPIreference

i would like to create a new Glass Table in this way.

End point still not working in updated & new ITSI v 4.0

Help is appreciated

Thanks

0 Karma

mitani
New Member

try this:

curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/glass_table -H "Content-Type:
application/json" -X POST -d '{
"content": [

],
"acl": {
    "can_share_global": true,
    "sharing": "app",
    "perms": {
        "read": [
            "*"
        ],
        "write": [
            "*"
        ]
    },
    "can_write": true,
    "owner": "xxx",
    "can_share_app": true,
    "modifiable": true,
    "can_change_perms": true,
    "can_share_user": true
},
"identifying_name": "xxx",
"title": "xxx",
"_owner": "nobody",
"_user": "nobody"

}'

Change XXX to your needs.

Good luck!

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...