Encountering HTTP 400 Bad Request Error for entity_filter_rule endpoint

Applicability

Description

| rest /servicesNS/nobody/SA-ITOA/itoa_interface/entity_filter_rule splunk_server=local report_as=text

The below error message is related to the HTTP 400 Bad Request Error.

The following error(s) and caution(s) occurred while the search ran. Therefore, search results might be incomplete.Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity_filter_rule?count=0&report_as=text from server=https://127.0.0.1:8089 - Bad RequestFailed to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity_filter_rule?count=0&report_as=text from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API.The REST request on the endpoint URI /servicesNS/nobody/SA-ITOA/itoa_interface/entity_filter_rule?count=0&report_as=text returned HTTP 'status not OK': code=400, Bad Request.

Investigation

Run the below SPL command to see the root cause of the error.

index=_internal source=*appserver.log* source="/opt/splunk/var/log/splunk/itsi_appserver.log" sourcetype=itsi_internal_log log_level=ERROR

There was a missing entry entity_filter_rule object in the capability matrix of itsi_utils.py, due to which the REST endpoint failed with status code 400 and with the message given below,

{"message": "No capabilities defined for "entity_filter_rule". Check your app's authorize.conf."}

The above message indicates that no capabilities are defined for the entity_filter_rule endpoint in the authorize.conf file.

Resolution

This is a functionality issue with the entity_filter_rule REST endpoint. This issue has already been noticed and will be fixed in the upcoming ITSI version 4.19.0.

Instead of using this REST endpoint, use the below lookup command as a workaround.

| inputlookup itsi_entity_filter_rules_lookup 

Related Links

ITSI REST Endpoints