Other Usage

Splunk REST API query (possible issue with URL encoding)

tomapatan
Communicator

Hi Everyone,

I`m learning about the Splunk REST API and I`m experiencing some temperamental behaviour, for example I can fetch results using the query listed below from some reports, but it fails for others, example below:

 

curl -k -H "Authorization: Splunk myValidToken" https://myValidDomainName.splunkcloud.com:8089/services/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

 Response:

 

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Could not find object id=[LOOKUP] Active Directory Devices No2</msg>
  </messages>
</response>

 

The report name is correct.

Have you got any suggestions for me ?

Many thanks,

Toma

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer

Hi,

This occurs when the object you're referencing is not visible in the user's default context. You can reference the user/app context directly with:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/<user>/<app>/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

where <user> and <app> are the user name and app name, respectively. If you have read access to the object but don't know the owner or app, you can use hyphens as wildcards:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/-/-/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

View solution in original post

0 Karma

tscroggins
Influencer

Hi,

This occurs when the object you're referencing is not visible in the user's default context. You can reference the user/app context directly with:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/<user>/<app>/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

where <user> and <app> are the user name and app name, respectively. If you have read access to the object but don't know the owner or app, you can use hyphens as wildcards:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/-/-/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

0 Karma

tomapatan
Communicator

Worked like a charm, much appreciated.

0 Karma
Get Updates on the Splunk Community!

3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...