Which of the following cURL commands would allow an engineer to effectively disable the REST API endpoint they've been utilizing for testing a detection named TestSearchDevelopment?

The correct answer is C. curl -k -u admin:pass. To disable a saved search (detection) via the Splunk REST API, the correct syntax is a POST request to the .../disable endpoint. Thus, the proper cURL command is curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/saved/searches/TestSearchDevelopment/disable

Performance Optimization and Troubleshooting

Question

Options

Acurl -k -u admin:pass
BSplunk endpoints cannot be disabled.
Ccurl -k -u admin:pass
Dcurl -k -u admin:pass

How the community answered

(33 responses)

A
3% (1)
B
3% (1)
C
85% (28)
D
9% (3)

Explanation

To disable a saved search (detection) via the Splunk REST API, the correct syntax is a POST request to the .../disable endpoint. Thus, the proper cURL command is curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/saved/searches/TestSearchDevelopment/disable

Topics

#REST API#cURL#detection management#API endpoint disable

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice