Other Usage

Splunk REST API query (possible issue with URL encoding)

tomapatan
Communicator

Hi Everyone,

I`m learning about the Splunk REST API and I`m experiencing some temperamental behaviour, for example I can fetch results using the query listed below from some reports, but it fails for others, example below:

 

curl -k -H "Authorization: Splunk myValidToken" https://myValidDomainName.splunkcloud.com:8089/services/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

 Response:

 

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Could not find object id=[LOOKUP] Active Directory Devices No2</msg>
  </messages>
</response>

 

The report name is correct.

Have you got any suggestions for me ?

Many thanks,

Toma

Labels (1)
0 Karma
1 Solution

tscroggins
Motivator

Hi,

This occurs when the object you're referencing is not visible in the user's default context. You can reference the user/app context directly with:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/<user>/<app>/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

where <user> and <app> are the user name and app name, respectively. If you have read access to the object but don't know the owner or app, you can use hyphens as wildcards:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/-/-/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

View solution in original post

0 Karma

tscroggins
Motivator

Hi,

This occurs when the object you're referencing is not visible in the user's default context. You can reference the user/app context directly with:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/<user>/<app>/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

where <user> and <app> are the user name and app name, respectively. If you have read access to the object but don't know the owner or app, you can use hyphens as wildcards:

https://myValidDomainName.splunkcloud.com:8089/servicesNS/-/-/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl

 

0 Karma

tomapatan
Communicator

Worked like a charm, much appreciated.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...