ES8 + Mission Control Usage rest API

[Nico99]

Hello everyone,

We have recently started using ES8 with Mission Control and we would like to use Mission Control's API to export information.

With the help of a POSTMAN, if we try to retrieve information from an investigation with https://SPLUNK:8089/servicesNS/nobody/missioncontrol/v1/incidents/ES-00001, we get the information.

Now in SPLUNK, if we pass the request | rest /servicesNS/nobody/missioncontrol, we get an answer.
However, if we try | rest /servicesNS/nobody/missioncontrol/v1/incidents/ES-00001, we don't get an error message but 0 result. My user has admin rights.

Does anyone have any idea why?
Did we miss something?

Thank you for the help!!!

[livehybrid · Accepted solution]

Hi @Nico99 

If you're using SPL to get the incident then you could use the following instead:

| mcincidentbyid id=ES-00001

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.