Splunk Search

ES8 + Mission Control Usage rest API

Nico99
Explorer

Hello everyone,

We have recently started using ES8 with Mission Control and we would like to use Mission Control's API to export information.

With the help of a POSTMAN, if we try to retrieve information from an investigation with https://SPLUNK:8089/servicesNS/nobody/missioncontrol/v1/incidents/ES-00001, we get the information.

Now in SPLUNK, if we pass the request | rest /servicesNS/nobody/missioncontrol, we get an answer.
However, if we try | rest /servicesNS/nobody/missioncontrol/v1/incidents/ES-00001, we don't get an error message but 0 result. My user has admin rights.

Does anyone have any idea why?
Did we miss something?

Thank you for the help!!!

0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @Nico99 

If you're using SPL to get the incident then you could use the following instead:

| mcincidentbyid id=ES-00001

 

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

View solution in original post

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Nico99 

If you're using SPL to get the incident then you could use the following instead:

| mcincidentbyid id=ES-00001

 

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...