As of now i follow this code and it works perfectly :
from splunklib.client import connect
service = connect(username="admin", password="changeme", host="myhost", app="search")
service.post('properties/macros/test', definition="test123")
print service.get('properties/macros/test/definition')["body"]
I see it here https://answers.splunk.com/answers/223843/rest-endpoint-for-modifying-applocalmacrosconf.html
But that code was to update ,
What if i want to add or delete a macro using the code ?
Hi @jadenhoho,
To create macro using Rest API, you can achieve like this
import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.post('properties/macros', __stanza="test")
service.post('properties/macros/test', definition="test123")
print service.get('properties/macros/test/definition')["body"]
I don't have idea about delete one.
Hi @jadenhoho,
To create macro using Rest API, you can achieve like this
import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.post('properties/macros', __stanza="test")
service.post('properties/macros/test', definition="test123")
print service.get('properties/macros/test/definition')["body"]
I don't have idea about delete one.
Thanks for that it is helpfull ,
i already tried
import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('properties/macros/name')
But it only does disable the macro but not delete it fully,
is there any function that apply that ?
This one worked for me for deleting macro using REST API
import splunklib.client as client
service = client.connect(username="admin", password="changeme", host="myhost", app="search")
service.delete('/servicesNS/nobody/search/admin/macros/test')
Thank you very much this code really help 🙂