Splunk Search

How can I update tags and corresponding permissions from a lookup table via Search Processing Language?

jedatt01
Builder

Hi, I have a list of hosts which are maintained and updated via a lookup table. Is it possible in Search Processing Language (SPL) to update tags and their permissions with the latest version of the lookup table? Isn't there a way to do REST calls in SPL?

0 Karma

woodcock
Esteemed Legend

Everything should be possible if you find the right endpoint. Start with this:

| rest/servicesNS/-/-/configs/conf-tags
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...