Skip to content

Conversation

@seiimonn
Copy link

@seiimonn seiimonn commented Oct 7, 2024

The current SDK does not provide dedicated functions for sending PUT and PATCH requests to endpoints in Splunk. These operations were only possible using the generic request method, which had issues correctly formatting a body payload, especially for form-encoded data.

This change introduces helper functions for PUT and POST requests, along with a new _prepare_request_body_and_url function to streamline body and URL preparation logic. This ensures consistency, reduces redundancy, and resolves issues with incorrect payload formatting when making these requests.

Changes

  • Added a _prepare_request_body_and_url helper function to handle body preparation and URL encoding for POST and PUT requests.
  • Added put() and updated post() methods to leverage the helper function.
  • Ensured proper handling of Content-Type headers for form-encoded data.

Benefits

  • Simplifies making PUT and PATCH requests directly without needing the generic request method.
  • Fixes body formatting issues, ensuring payloads are correctly encoded.

@Ickerday
Copy link
Collaborator

Ickerday commented Aug 21, 2025

Dismissed as stale. Please tell us if the issue persists!

@Ickerday Ickerday closed this Aug 21, 2025
@seiimonn
Copy link
Author

This is still very much sought after by my team. Let me know if you need anything for this to be merged.

@Ickerday
Copy link
Collaborator

Ickerday commented Sep 9, 2025

Thanks @seiimonn, we'll take a look and get back to you!

@Ickerday Ickerday reopened this Sep 9, 2025
@seiimonn
Copy link
Author

Hi @Ickerday - anything I can do to support on this?

@mateusz834
Copy link
Contributor

mateusz834 commented Nov 4, 2025

Hi

We plan to give this a look, we are going to figure out which way is the best to implement this (we might go with this change) but in the meantime can you rebase this on top of the develop branch?

@mateusz834
Copy link
Contributor

Thanks, once again i would ask you to rebase this, since i would like to see this being also tested with the tests i have introduced for #683.

Please add in tests/system/test_cre_apps.py TestJSONCustomRestEndpointsSpecialMethodHelpers a test case for PUT and PATCH, i assume they would look the same as test_POST.

message = {"method": method, "headers": all_headers}
path = path + UrlEncoded('?' + body, skip_encode=True)
message = {'method': method,
'headers': all_headers}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop that change. It seems to only make the code non-formatted.

Comment on lines +916 to +936
**Example**::
c = binding.connect(...)
c.post('saved/searches', name='boris',
search='search * earliest=-1m | head 1') == \\
{'body': ...a response reader object...,
'headers': [('content-length', '10455'),
('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'),
('server', 'Splunkd'),
('connection', 'close'),
('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'),
('date', 'Fri, 11 May 2012 16:46:06 GMT'),
('content-type', 'text/xml; charset=utf-8')],
'reason': 'Created',
'status': 201}
c.post('nonexistant/path') # raises HTTPError
c.logout()
# raises AuthenticationError:
c.put('saved/searches/boris',
search='search * earliest=-1m | head 1')
"""
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should change this example, splunk does not really support PUT/PATCH in its endpoints see: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.0/introduction/endpoints-reference-list (that is the reason there were no such methods in the first place)

I think we should have an example that shows that it is used with custom rest endpoints, something like:

# Call an HTTP endpoint, exposed as Custom Rest Endpoint in a Splunk App.
# PUT /servicesNS/-/app_name/custom_rest_endpoint
service.put(
     app="app_name",
     path_segment="custom_rest_endpoint",
     body=json.dumps({"key": "val"}),
     headers=[("Content-Type", "application/json")],
)

Comment on lines +1000 to +1017
c = binding.connect(...)
c.post('saved/searches', name='boris',
search='search * earliest=-1m | head 1') == \\
{'body': ...a response reader object...,
'headers': [('content-length', '10455'),
('expires', 'Fri, 30 Oct 1998 00:00:00 GMT'),
('server', 'Splunkd'),
('connection', 'close'),
('cache-control', 'no-store, max-age=0, must-revalidate, no-cache'),
('date', 'Fri, 11 May 2012 16:46:06 GMT'),
('content-type', 'text/xml; charset=utf-8')],
'reason': 'Created',
'status': 201}
c.post('nonexistant/path') # raises HTTPError
c.logout()
# raises AuthenticationError:
c.patch('saved/searches/boris',
search='search * earliest=-1m | head 1')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, lets change it, as above.

:type headers: ``list`` of 2-tuples.
:param query: All other keyword arguments, which are used as query
parameters.
:param body: Parameters to be used in the post body. If specified,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
:param body: Parameters to be used in the post body. If specified,
:param body: Parameters to be used in the put body. If specified,

:type headers: ``list`` of 2-tuples.
:param query: All other keyword arguments, which are used as query
parameters.
:param body: Parameters to be used in the post body. If specified,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
:param body: Parameters to be used in the post body. If specified,
:param body: Parameters to be used in the patch body. If specified,

Comment on lines +881 to +886
Some of Splunk's endpoints, such as ``receivers/simple`` and
``receivers/stream``, require unstructured data in the PUT body
and all metadata passed as GET-style arguments. If you provide
a ``body`` argument to ``put``, it will be used as the PUT
body, and all other keyword arguments will be passed as
GET-style arguments in the URL.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Splunk does not support PUT method in its endpoints, so lets not mention that.

Suggested change
Some of Splunk's endpoints, such as ``receivers/simple`` and
``receivers/stream``, require unstructured data in the PUT body
and all metadata passed as GET-style arguments. If you provide
a ``body`` argument to ``put``, it will be used as the PUT
body, and all other keyword arguments will be passed as
GET-style arguments in the URL.
If you provide a ``body`` argument to ``put``,
it will be used as the PUT body, and all other
keyword arguments will be passed as GET-style
arguments in the URL.

Comment on lines +963 to +968
Some of Splunk's endpoints, such as ``receivers/simple`` and
``receivers/stream``, require unstructured data in the PATCH body
and all metadata passed as GET-style arguments. If you provide
a ``body`` argument to ``patch``, it will be used as the PATCH
body, and all other keyword arguments will be passed as
GET-style arguments in the URL.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

@Ickerday Ickerday marked this pull request as draft November 17, 2025 15:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants