A grateful shout out to my awesome Splunk Sales Manager, who connected me to the right ITOA support and Michael Bentley who developed this great app,"Webtools Add-on" https://splunkbase.splunk.com/app/4146/#/details, available on Splunkbase. I appreciate Michael actively supports this app and responded quickly to my email with guidance.
Solution:
First, generate and stream a single result to properly eval the 'data' field for use in my curl command
Second, I need to add the _key field to my API POST command payload; the _key is the ITSI 'serviceid' value
Third, the ITSI REST API 'service' object's attribute is all lower case, 'enabled' vs. errant 'Enabled' described in the ITSI REST API Schema documentation https://docs.splunk.com/Documentation/ITSI/4.4.2/RESTAPI/ITSIRESTAPIschema#Service,
Finally, remove the "/" (forward slash) at the end of the uri, between the serviceid and ?is_partial_data=1
Putting it all together, these steps solved my problem and I can enable and disable ITSI services using the REST API interface:
Step 1
index=_internal
| head 1
Step 2 and 3
| eval header="{\"content-type\":\"application/json\"}"
| eval data="{\"enabled\": 0,\"_key\":\"dc3b486e-2ec5-4f09-9dab-3714fc5f536f\"}"
Step 4
/service/dc3b486e-2ec5-4f09-9dab-3714fc5f53 '6f?is' _partial_data=1
| curl method=post uri=https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/service/dc3b486e-2ec5-4f09-9dab-3714fc5f536f?is_partial_data=1 splunkauth=true debug=true headerfield=header datafield=data
Example of a functional SPL query to disable an ITSI service (change the value to 1 in eval of 'data' to enable an ITSI service):
index=_internal
| head 1
| eval header="{\"content-type\":\"application/json\"}"
| eval data="{\"enabled\": 0,\"_key\":\"dc3b486e-2ec5-4f09-9dab-3714fc5f536f\"}"
| curl method=post uri=https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/service/dc3b486e-2ec5-4f09-9dab-3714fc5f536f?is_partial_data=1 splunkauth=true debug=true headerfield=header datafield=data
... View more
