Hiya,
I am trying to use the ITSI REST API to update entities in my splunk development.
I am able to create entities and overwrite pre existing entities which have the same `_key` value.
But I want to just update an entity without overwriting/deleting any data.
So say I have an entity with 2 info fields:
"cpu_cores = 4"
"memory = 32"
and I just want to update the "cpu_cores" field to be "cpu_cores = 8" and leave the "memory" field the same, but whenever I execute the post request it overwrites the info fields and deletes the "memory" Field.
Below is the Endpoint I am using and the JSON object to update the entity:
Endpoint
https://<my_ip>:8089/servicesNS/nobody/itsi/itoa_interface/entity/bulk_update/?is_partial_data=1
JSON Object
[
{
"_key":"aa_entity_1",
"title": "aa entity 1",
"object_type": "entity",
"description": "Just a test",
"informational": {
"fields": [
"cpu_cores"
],
"values": [
"8"
]
},
"cpu_cores": [
"8"
]
}
]
This JSON creates the entity fine, and what I understand from the documentation is that the "is_partial_data=1" should mean that it will only update data and not remove any, I have looked around and tried different things with the "is_partial_data=1". I've tried putting it into the JSON Object as "is_partial_data":true,
In the endpoint I saw somewhere that the "/" shouldn't be present before the "?is_partial_data=1", but this didnt work either.
Any help would be appreciated.
Addtional Info:
Splunk Enterprise: 9.0.3
ITSI Version: 4.13.2
Using Postman to do post request
Hi!
What is not working for you the "/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1" endpoint? What was the response?
This works for me on SE 9.0.3
curl -k -u user:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity/bulk_update?is_partial_data=1 -H "Content-Type: application json" -X POST -d '[{"_key":"entity_guid","cpu":["56"]}]'
Note that the payload needs to be a JSON list.