Hiya, I am trying to use the ITSI REST API to update entities in my splunk development.
I am able to create entities and overwrite pre existing entities which have the same `_key` value.
But I want to just update an entity without overwriting/deleting any data. So say I have an entity with 2 info fields: "cpu_cores = 4" "memory = 32" and I just want to update the "cpu_cores" field to be "cpu_cores = 8" and leave the "memory" field the same, but whenever I execute the post request it overwrites the info fields and deletes the "memory" Field. Below is the Endpoint I am using and the JSON object to update the entity:
Endpoint https://<my_ip>:8089/servicesNS/nobody/itsi/itoa_interface/entity/bulk_update/?is_partial_data=1
JSON Object
[
{
"_key":"aa_entity_1",
"title": "aa entity 1",
"object_type": "entity",
"description": "Just a test",
"informational": {
"fields": [
"cpu_cores"
],
"values": [
"8"
]
},
"cpu_cores": [
"8"
]
}
]
This JSON creates the entity fine, and what I understand from the documentation is that the "is_partial_data=1" should mean that it will only update data and not remove any, I have looked around and tried different things with the "is_partial_data=1". I've tried putting it into the JSON Object as "is_partial_data":true, In the endpoint I saw somewhere that the "/" shouldn't be present before the "?is_partial_data=1", but this didnt work either.
Any help would be appreciated.
Addtional Info:
Splunk Enterprise: 9.0.3 ITSI Version: 4.13.2 Using Postman to do post request
... View more