Splunk Search

How can I update tags and corresponding permissions from a lookup table via Search Processing Language?


Hi, I have a list of hosts which are maintained and updated via a lookup table. Is it possible in Search Processing Language (SPL) to update tags and their permissions with the latest version of the lookup table? Isn't there a way to do REST calls in SPL?

0 Karma

Esteemed Legend

Everything should be possible if you find the right endpoint. Start with this:

| rest/servicesNS/-/-/configs/conf-tags
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!