How to import containers via rest api?

[dennyw]

We have a need to migrate our phantom data to another instance including the containers. 

Though it's not listed in REST Containers - Splunk Documentation, i was able to export the containers via /rest/container/{id}/export

however, i didn't find the rest endpoint for importing the containers.

any advice will be appreciated.

[phanTom · Accepted solution]

@dennyw I think you would be better backing up and restoring to the other system *(must be the same version). The REST call you did pulls down individual files containing the container JSON.

I am not aware of a way to import the .gz files via REST with the only way being the manual press of the Import button.

You may even be better off using a script to hit REST to GET from the old and POST to the new system. You would likely need to remove container id's and source_data_identifiers before POSTing.

As you can see there are a few ways to do things in SOAR!

-- If this helped, please mark as a solution! Happy SOARing --