REST API unable to enable saved search

Applicability

Description

rest command used to enable REST point

curl -X POST --header 'Authorization: Bearer <tokenhere>' 'https://<MYSTACK>.splunkcloud.com:8089/servicesNS/job_owner_default/au_automationanywhere_shc_app/saved/searches/my_alert_controlroom_error_alert_5m/enable'

resulted in:

note the difference between the "Owner"

Investigation

Breaking down the CURL

curl -X POST --header 'Authorization: Bearer <tokenhere>' 'https://<MYSTACK>.splunkcloud.com:8089/servicesNS/job_owner_default/au_automationanywhere_shc_app/saved/searches/my_alert_controlroom_error_alert_5m/enable'

Note the container

> /job_owner_default/ <  the same as the owner field "job_owner_default"

While the target endpoint is "admin"

We can deduce now that the CURL is hitting the wrong endpoint and as there is no existing job under this endpoint it will create the job.

Resolution

We need to point to the correct endpoint

curl -X POST --header 'Authorization: Bearer <tokenhere>' '
https://<MY_STACK>.splunkcloud.com:8089/servicesNS/nobody/au_automationanywhere_shc_app/saved/searches/automationanywhere_alert_controlroom_error_alert_5m/disable'

Note Owner "admin" maps to the nobody service account 

Thus the curl needs to have >/nobody/< In place of account job_owner_default

Related Links

reference for commandlets

RESTREF RESTconf

POST
Update or add property to {stanza} in {file} configuration file.
Request parameters
Name	Type	Description
<variable>	String	Arbitrary number of key/value pairs to update.
Response keys
None
Example request and response
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs -d SHOULD_LINEMERGE=true