I've checked in with our dev team and it shouldn't be necessary to provide the _key for this get operation. We already have this identified as an issue to fix in the next maintenance release, which should be 4.7.3. We haven't set a date for that yet, but it will be upcoming this fall. In the meantime, best to follow Kyle's much more currently useful advice. ... View more

Not as of ES 4.5. Splunk Enterprise Security generally avoids depending on new features in a Splunk Enterprise release in the same quarter. This feature is planned for a future release. ... View more