Configurations
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
- configs/conf-{file}
- GET configs/conf-{file}
- POST configs/conf-{file}
- configs/conf-{file}/{name}
- DELETE configs/conf-{file}/{name}
- GET configs/conf-{file}/{name}
- POST configs/conf-{file}/{name}
- properties
- GET properties
- POST properties
- properties/{file_name}
- GET properties/{file_name}
- POST properties/{file_name}
- properties/{file_name}/{stanza_name}
- GET properties/{file_name}/{stanza_name}
- POST properties/{file_name}/{stanza_name}
- properties/{file_name}/{stanza_name}/{key_name}
- GET properties/{file_name}/{stanza_name}/{key_name}
- POST properties/{file_name}/{stanza_name}/{key_name}
Configurations
Use the Configuration endpoints to access and modify Splunk configuration files and settings.
An understanding of how Splunk uses configuration files helps understand how to use these endpoints. Refer to About Configuration Files and Configuration File Precedence in the Splunk Admin manual.
The topic Accessing and updating Splunk configurations in this manual describes the differences between the configs/conf-{file}/ and properties/ endpoints.
configs/conf-{file}
Provides raw access to Splunk's ".conf" configuration files.
Refer to Accessing and updating Splunk configurations for a comparison of these endpoints with the properties/ endpoints.
GET configs/conf-{file}
Lists all stanzas contained in the named configuration file.
Request
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| count | Number | 30 | Maximum number of items to return. | |
| offset | Number | 0 | Index for first item to return. | |
| search | String | Boolean predicate to filter results. | ||
| sort_dir | String | name | Direction to sort by (asc/desc). | |
| sort_key | String | name | Field to sort by. | |
| sort_mode | String | name | Collating sequence for the sort (auto, alpha, alpha_case, num). |
Response Codes
| Status Code | Description |
|---|---|
| 200 | Listed successfully. |
| 401 | Authentication failure: must pass valid credentials with request. |
| 403 | Insufficient permissions to view configuration file. |
| 500 | Internal server error. See response body for details. |
Returned Values
No values returned for this request.
Example
Displays the stanzas existing in props.conf.
curl -k -u admin:pass https://localhost:8089/services/configs/conf-props
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>conf-props</title>
<id>https://localhost:8089/services/configs/conf-props</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<link href="/services/configs/conf-props/_new" rel="create"/>
<link href="/services/configs/conf-props/_reload" rel="_reload"/>
<!-- opensearch nodes elided for brevity. -->
<s:messages/>
<entry>
<title>(?i)source::....zip(.\d+)?</title>
<id>https://localhost:8089/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="list"/>
<link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="edit"/>
<link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="ANNOTATE_PUNCT">1</s:key>
<s:key name="BREAK_ONLY_BEFORE"/>
<s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
<s:key name="CHARSET">UTF-8</s:key>
<s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
<s:key name="HEADER_MODE"/>
<s:key name="LEARN_SOURCETYPE">1</s:key>
<s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
<s:key name="MAX_DAYS_AGO">2000</s:key>
<s:key name="MAX_DAYS_HENCE">2</s:key>
<s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
<s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
<s:key name="MAX_EVENTS">256</s:key>
<s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
<s:key name="MUST_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_BEFORE"/>
<s:key name="NO_BINARY_CHECK">1</s:key>
<s:key name="SEGMENTATION">indexing</s:key>
<s:key name="SEGMENTATION-all">full</s:key>
<s:key name="SEGMENTATION-inner">inner</s:key>
<s:key name="SEGMENTATION-outer">outer</s:key>
<s:key name="SEGMENTATION-raw">none</s:key>
<s:key name="SEGMENTATION-standard">standard</s:key>
<s:key name="SHOULD_LINEMERGE">1</s:key>
<s:key name="TRANSFORMS"/>
<s:key name="TRUNCATE">10000</s:key>
<s:key name="disabled">0</s:key>
<!-- eai:acl nodes elided for brevity. -->
<s:key name="eai:appName">search</s:key>
<s:key name="eai:userName">admin</s:key>
<s:key name="maxDist">100</s:key>
<s:key name="sourcetype">preprocess-zip</s:key>
<s:key name="unarchive_cmd">_auto</s:key>
</s:dict>
</content>
</entry>
</feed>
POST configs/conf-{file}
Allows for creating the stanza specified by "name" in the configuration file specified by {file}.
Request
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| name | String | | The name of the stanza to create. | |
| <key> | String | This operation accepts an arbitrary set of key/value pairs to populate in the created stanza. (There is no actual parameter named "key".) |
Response Codes
| Status Code | Description |
|---|---|
| 201 | Created successfully. |
| 401 | Authentication failure: must pass valid credentials with request. |
| 403 | Insufficient permissions to create configuration stanza. |
| 500 | Internal server error. See response body for details. |
Returned Values
No values returned for this request.
Example
Configures the sourcetype "myweblogs" in props.conf to use the UTF-8 character set and disable line-merging.
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props \ -d name=myweblogs \ -d CHARSET=UTF-8 \ -d SHOULD_LINEMERGE=false
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>conf-props</title>
<id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
<link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
<!-- opensearch nodes elided for brevity. -->
<s:messages/>
<entry>
<title>myweblogs</title>
<id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="alternate"/>
<author>
<name>admin</name>
</author>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="list"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="edit"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="remove"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/move" rel="move"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="ANNOTATE_PUNCT">1</s:key>
<s:key name="BREAK_ONLY_BEFORE"/>
<s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
<s:key name="CHARSET">UTF-8</s:key>
<s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
<s:key name="HEADER_MODE"/>
<s:key name="LEARN_SOURCETYPE">1</s:key>
<s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
<s:key name="MAX_DAYS_AGO">2000</s:key>
<s:key name="MAX_DAYS_HENCE">2</s:key>
<s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
<s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
<s:key name="MAX_EVENTS">256</s:key>
<s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
<s:key name="MUST_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_BEFORE"/>
<s:key name="SEGMENTATION">indexing</s:key>
<s:key name="SEGMENTATION-all">full</s:key>
<s:key name="SEGMENTATION-inner">inner</s:key>
<s:key name="SEGMENTATION-outer">outer</s:key>
<s:key name="SEGMENTATION-raw">none</s:key>
<s:key name="SEGMENTATION-standard">standard</s:key>
<s:key name="SHOULD_LINEMERGE">0</s:key>
<s:key name="TRANSFORMS"/>
<s:key name="TRUNCATE">10000</s:key>
<s:key name="disabled">0</s:key>
<!-- eai:acl nodes elided for brevity. -->
<s:key name="eai:appName">search</s:key>
<s:key name="eai:userName">admin</s:key>
<s:key name="maxDist">100</s:key>
</s:dict>
</content>
</entry>
</feed>
configs/conf-{file}/{name}
DELETE configs/conf-{file}/{name}
Deletes the named stanza in the named configuration file.
Request
No parameters for this request.
Response Codes
| Status Code | Description |
|---|---|
| 200 | Deleted successfully. |
| 401 | Authentication failure: must pass valid credentials with request. |
| 403 | Insufficient permissions to delete configuration stanza. |
| 500 | Internal server error. See response body for details. |
Returned Values
No values returned for this request.
Example
Deletes the configuration stanza for sourcetype "myweblogs" in props.conf.
curl -k -u admin:pass --request DELETE \ https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>conf-props</title>
<id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
<updated>2011-07-08T01:01:27-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
<link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
<!-- opensearch nodes elided for brevity. -->
<s:messages/>
</feed>
GET configs/conf-{file}/{name}
Display only the named stanza from the named configuration file.
Request
No parameters for this request.
Response Codes
| Status Code | Description |
|---|---|
| 200 | Listed successfully. |
| 401 | Authentication failure: must pass valid credentials with request. |
| 403 | Insufficient permissions to view configuration stanza. |
| 500 | Internal server error. See response body for details. |
Returned Values
No values returned for this request.
Example
Displays only the configuration for the "myweblogs" sourcetype in props.conf.
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>conf-props</title>
<id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
<link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
<!-- opensearch nodes elided for brevity. -->
<s:messages/>
<entry>
<title>myweblogs</title>
<id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="alternate"/>
<author>
<name>admin</name>
</author>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="list"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="edit"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="remove"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/move" rel="move"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="ANNOTATE_PUNCT">1</s:key>
<s:key name="BREAK_ONLY_BEFORE"/>
<s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
<s:key name="CHARSET">UTF-8</s:key>
<s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
<s:key name="HEADER_MODE"/>
<s:key name="LEARN_SOURCETYPE">1</s:key>
<s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
<s:key name="MAX_DAYS_AGO">2000</s:key>
<s:key name="MAX_DAYS_HENCE">2</s:key>
<s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
<s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
<s:key name="MAX_EVENTS">256</s:key>
<s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
<s:key name="MUST_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_BEFORE"/>
<s:key name="SEGMENTATION">indexing</s:key>
<s:key name="SEGMENTATION-all">full</s:key>
<s:key name="SEGMENTATION-inner">inner</s:key>
<s:key name="SEGMENTATION-outer">outer</s:key>
<s:key name="SEGMENTATION-raw">none</s:key>
<s:key name="SEGMENTATION-standard">standard</s:key>
<s:key name="SHOULD_LINEMERGE">0</s:key>
<s:key name="TRANSFORMS"/>
<s:key name="TRUNCATE">10000</s:key>
<s:key name="disabled">0</s:key>
<!-- eai:acl nodes elided for brevity. -->
<s:key name="eai:appName">search</s:key>
<s:key name="eai:attributes">
<s:dict>
<s:key name="optionalFields">
<s:list/>
</s:key>
<s:key name="requiredFields">
<s:list/>
</s:key>
<s:key name="wildcardFields">
<s:list>
<s:item>.*</s:item>
</s:list>
</s:key>
</s:dict>
</s:key>
<s:key name="eai:userName">admin</s:key>
<s:key name="maxDist">100</s:key>
</s:dict>
</content>
</entry>
</feed>
POST configs/conf-{file}/{name}
Allows for editing the named stanza from the named configuration file.
Request
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| <key> | String | This operation accepts an arbitrary set of key/value pairs to populate in the created stanza. (There is no actual parameter named "key".) |
Response Codes
| Status Code | Description |
|---|---|
| 200 | Updated successfully. |
| 401 | Authentication failure: must pass valid credentials with request. |
| 403 | Insufficient permissions to edit configuration stanza. |
| 500 | Internal server error. See response body for details. |
Returned Values
No values returned for this request.
Example
Enables line-merging for the "myweblogs" sourcetype existing in props.conf.
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs \ -d SHOULD_LINEMERGE=true
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>conf-props</title>
<id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
<link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
<!-- opensearch nodes elided for brevity. -->
<s:messages/>
<entry>
<title>myweblogs</title>
<id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs</id>
<updated>2011-07-08T01:01:26-07:00</updated>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="alternate"/>
<author>
<name>admin</name>
</author>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="list"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="edit"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="remove"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/move" rel="move"/>
<link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/disable" rel="disable"/>
<content type="text/xml">
<s:dict>
<s:key name="ANNOTATE_PUNCT">1</s:key>
<s:key name="BREAK_ONLY_BEFORE"/>
<s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
<s:key name="CHARSET">UTF-8</s:key>
<s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
<s:key name="HEADER_MODE"/>
<s:key name="LEARN_SOURCETYPE">1</s:key>
<s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
<s:key name="MAX_DAYS_AGO">2000</s:key>
<s:key name="MAX_DAYS_HENCE">2</s:key>
<s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
<s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
<s:key name="MAX_EVENTS">256</s:key>
<s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
<s:key name="MUST_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_AFTER"/>
<s:key name="MUST_NOT_BREAK_BEFORE"/>
<s:key name="SEGMENTATION">indexing</s:key>
<s:key name="SEGMENTATION-all">full</s:key>
<s:key name="SEGMENTATION-inner">inner</s:key>
<s:key name="SEGMENTATION-outer">outer</s:key>
<s:key name="SEGMENTATION-raw">none</s:key>
<s:key name="SEGMENTATION-standard">standard</s:key>
<s:key name="SHOULD_LINEMERGE">1</s:key>
<s:key name="TRANSFORMS"/>
<s:key name="TRUNCATE">10000</s:key>
<s:key name="disabled">0</s:key>
<!-- eai:acl nodes elided for brevity. -->
<s:key name="eai:appName">search</s:key>
<s:key name="eai:userName">admin</s:key>
<s:key name="maxDist">100</s:key>
</s:dict>
</content>
</entry>
</feed>
properties
Provides access to configuration files.
Refer to Accessing and updating Splunk configurations for a comparison of these endpoints with the configs/conf-{file} endpoints.
Note: The DELETE operation from the properties endpoint is deprecated and will be removed from future releases. Instead, use the DELETE operation from the configs/conf-{file}/{name} endpoint.
GET properties
Returns a list of configurations that are saved in configuration files.
Request
No parameters for this request.
Response Codes
| Status Code | Description |
|---|---|
| 200 | Listed successfully. |
Returned Values
No values returned for this request.
Example
Lists the names of all configuration files known to the Splunk instance.
curl -k -u admin:pass https://localhost:8089/services/properties
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>properties</title>
<id>https://localhost:8089/services/properties</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<entry>
<title>alert_actions</title>
<id>https://localhost:8089/services/properties/alert_actions</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/alert_actions" rel="alternate"/>
</entry>
<entry>
<title>app</title>
<id>https://localhost:8089/services/properties/app</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/app" rel="alternate"/>
</entry>
<entry>
<title>audit</title>
<id>https://localhost:8089/services/properties/audit</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/audit" rel="alternate"/>
</entry>
<entry>
<title>authentication</title>
<id>https://localhost:8089/services/properties/authentication</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/authentication" rel="alternate"/>
</entry>
<entry>
<title>authorize</title>
<id>https://localhost:8089/services/properties/authorize</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/authorize" rel="alternate"/>
</entry>
<entry>
<title>commands</title>
<id>https://localhost:8089/services/properties/commands</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/commands" rel="alternate"/>
</entry>
<entry>
<title>conf</title>
<id>https://localhost:8089/services/properties/conf</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/conf" rel="alternate"/>
</entry>
<entry>
<title>crawl</title>
<id>https://localhost:8089/services/properties/crawl</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/crawl" rel="alternate"/>
</entry>
<entry>
<title>datatypesbnf</title>
<id>https://localhost:8089/services/properties/datatypesbnf</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/datatypesbnf" rel="alternate"/>
</entry>
<entry>
<title>default-mode</title>
<id>https://localhost:8089/services/properties/default-mode</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/default-mode" rel="alternate"/>
</entry>
<entry>
<title>deploymentclient</title>
<id>https://localhost:8089/services/properties/deploymentclient</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/deploymentclient" rel="alternate"/>
</entry>
<entry>
<title>distsearch</title>
<id>https://localhost:8089/services/properties/distsearch</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/distsearch" rel="alternate"/>
</entry>
<entry>
<title>event_renderers</title>
<id>https://localhost:8089/services/properties/event_renderers</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/event_renderers" rel="alternate"/>
</entry>
<entry>
<title>eventdiscoverer</title>
<id>https://localhost:8089/services/properties/eventdiscoverer</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/eventdiscoverer" rel="alternate"/>
</entry>
<entry>
<title>eventtypes</title>
<id>https://localhost:8089/services/properties/eventtypes</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/eventtypes" rel="alternate"/>
</entry>
<entry>
<title>fields</title>
<id>https://localhost:8089/services/properties/fields</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/fields" rel="alternate"/>
</entry>
<entry>
<title>indexes</title>
<id>https://localhost:8089/services/properties/indexes</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/indexes" rel="alternate"/>
</entry>
<entry>
<title>inputs</title>
<id>https://localhost:8089/services/properties/inputs</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/inputs" rel="alternate"/>
</entry>
<entry>
<title>launcher</title>
<id>https://localhost:8089/services/properties/launcher</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/launcher" rel="alternate"/>
</entry>
<entry>
<title>limits</title>
<id>https://localhost:8089/services/properties/limits</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/limits" rel="alternate"/>
</entry>
<entry>
<title>literals</title>
<id>https://localhost:8089/services/properties/literals</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/literals" rel="alternate"/>
</entry>
<entry>
<title>lookups</title>
<id>https://localhost:8089/services/properties/lookups</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/lookups" rel="alternate"/>
</entry>
<entry>
<title>macros</title>
<id>https://localhost:8089/services/properties/macros</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/macros" rel="alternate"/>
</entry>
<entry>
<title>manager</title>
<id>https://localhost:8089/services/properties/manager</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/manager" rel="alternate"/>
</entry>
<entry>
<title>nav</title>
<id>https://localhost:8089/services/properties/nav</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/nav" rel="alternate"/>
</entry>
<entry>
<title>outputs</title>
<id>https://localhost:8089/services/properties/outputs</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/outputs" rel="alternate"/>
</entry>
<entry>
<title>pdf_server</title>
<id>https://localhost:8089/services/properties/pdf_server</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/pdf_server" rel="alternate"/>
</entry>
<entry>
<title>prefs</title>
<id>https://localhost:8089/services/properties/prefs</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/prefs" rel="alternate"/>
</entry>
<entry>
<title>props</title>
<id>https://localhost:8089/services/properties/props</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/props" rel="alternate"/>
</entry>
<entry>
<title>quickstart</title>
<id>https://localhost:8089/services/properties/quickstart</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/quickstart" rel="alternate"/>
</entry>
<entry>
<title>restmap</title>
<id>https://localhost:8089/services/properties/restmap</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/restmap" rel="alternate"/>
</entry>
<entry>
<title>savedsearches</title>
<id>https://localhost:8089/services/properties/savedsearches</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/savedsearches" rel="alternate"/>
</entry>
<entry>
<title>searchbnf</title>
<id>https://localhost:8089/services/properties/searchbnf</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/searchbnf" rel="alternate"/>
</entry>
<entry>
<title>searchscripts</title>
<id>https://localhost:8089/services/properties/searchscripts</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/searchscripts" rel="alternate"/>
</entry>
<entry>
<title>segmenters</title>
<id>https://localhost:8089/services/properties/segmenters</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/segmenters" rel="alternate"/>
</entry>
<entry>
<title>server</title>
<id>https://localhost:8089/services/properties/server</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/server" rel="alternate"/>
</entry>
<entry>
<title>serverclass</title>
<id>https://localhost:8089/services/properties/serverclass</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/serverclass" rel="alternate"/>
</entry>
<entry>
<title>source-classifier</title>
<id>https://localhost:8089/services/properties/source-classifier</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/source-classifier" rel="alternate"/>
</entry>
<entry>
<title>sourcetypes</title>
<id>https://localhost:8089/services/properties/sourcetypes</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/sourcetypes" rel="alternate"/>
</entry>
<entry>
<title>tenants</title>
<id>https://localhost:8089/services/properties/tenants</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/tenants" rel="alternate"/>
</entry>
<entry>
<title>times</title>
<id>https://localhost:8089/services/properties/times</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/times" rel="alternate"/>
</entry>
<entry>
<title>transactiontypes</title>
<id>https://localhost:8089/services/properties/transactiontypes</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/transactiontypes" rel="alternate"/>
</entry>
<entry>
<title>transforms</title>
<id>https://localhost:8089/services/properties/transforms</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/transforms" rel="alternate"/>
</entry>
<entry>
<title>user-prefs</title>
<id>https://localhost:8089/services/properties/user-prefs</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/user-prefs" rel="alternate"/>
</entry>
<entry>
<title>views</title>
<id>https://localhost:8089/services/properties/views</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/views" rel="alternate"/>
</entry>
<entry>
<title>viewstates</title>
<id>https://localhost:8089/services/properties/viewstates</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/viewstates" rel="alternate"/>
</entry>
<entry>
<title>web</title>
<id>https://localhost:8089/services/properties/web</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/web" rel="alternate"/>
</entry>
<entry>
<title>workflow_actions</title>
<id>https://localhost:8089/services/properties/workflow_actions</id>
<updated>2011-07-08T11:33:18-07:00</updated>
<link href="/services/properties/workflow_actions" rel="alternate"/>
</entry>
</feed>
POST properties
Creates a new configuration file.
Request
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| __conf | String | | The name of the configuration file to create.
Note: Double underscore before conf. |
Response Codes
| Status Code | Description |
|---|---|
| 201 | Created successfully. |
| 400 | Request error. See response body for details. |
Returned Values
No values returned for this request.
Example
Creates a new configuration file named myapp.conf.
curl -k -u admin:pass https://localhost:8089/services/properties \ -d __conf=myapp
Empty response.
properties/{file_name}
GET properties/{file_name}
Returns a list of stanzas in the configuration file specified by {name}.
Request
No parameters for this request.
Response Codes
| Status Code | Description |
|---|---|
| 200 | Listed successfully. |
| 404 | Named file does not exist. |
Returned Values
No values returned for this request.
Example
Display configuration stanzas for the props.conf file.
curl -k -u admin:pass https://localhost:8089/services/properties/props
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>props</title>
<id>https://localhost:8089/services/properties/props</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<entry>
<title>(?i)source::....zip(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>ActiveDirectory</title>
<id>https://localhost:8089/services/properties/props/ActiveDirectory</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/ActiveDirectory" rel="alternate"/>
</entry>
<entry>
<title>PerformanceMonitor</title>
<id>https://localhost:8089/services/properties/props/PerformanceMonitor</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/PerformanceMonitor" rel="alternate"/>
</entry>
<entry>
<title>WinRegistry</title>
<id>https://localhost:8089/services/properties/props/WinRegistry</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/WinRegistry" rel="alternate"/>
</entry>
<entry>
<title>__singleline</title>
<id>https://localhost:8089/services/properties/props/__singleline</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/__singleline" rel="alternate"/>
</entry>
<entry>
<title>access_combined</title>
<id>https://localhost:8089/services/properties/props/access_combined</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/access_combined" rel="alternate"/>
</entry>
<entry>
<title>access_combined_wcookie</title>
<id>https://localhost:8089/services/properties/props/access_combined_wcookie</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/access_combined_wcookie" rel="alternate"/>
</entry>
<entry>
<title>access_common</title>
<id>https://localhost:8089/services/properties/props/access_common</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/access_common" rel="alternate"/>
</entry>
<entry>
<title>anaconda</title>
<id>https://localhost:8089/services/properties/props/anaconda</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/anaconda" rel="alternate"/>
</entry>
<entry>
<title>anaconda_syslog</title>
<id>https://localhost:8089/services/properties/props/anaconda_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/anaconda_syslog" rel="alternate"/>
</entry>
<entry>
<title>apache_error</title>
<id>https://localhost:8089/services/properties/props/apache_error</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/apache_error" rel="alternate"/>
</entry>
<entry>
<title>asterisk_cdr</title>
<id>https://localhost:8089/services/properties/props/asterisk_cdr</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/asterisk_cdr" rel="alternate"/>
</entry>
<entry>
<title>asterisk_event</title>
<id>https://localhost:8089/services/properties/props/asterisk_event</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/asterisk_event" rel="alternate"/>
</entry>
<entry>
<title>asterisk_messages</title>
<id>https://localhost:8089/services/properties/props/asterisk_messages</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/asterisk_messages" rel="alternate"/>
</entry>
<entry>
<title>asterisk_queue</title>
<id>https://localhost:8089/services/properties/props/asterisk_queue</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/asterisk_queue" rel="alternate"/>
</entry>
<entry>
<title>backup_file</title>
<id>https://localhost:8089/services/properties/props/backup_file</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/backup_file" rel="alternate"/>
</entry>
<entry>
<title>breakable_text</title>
<id>https://localhost:8089/services/properties/props/breakable_text</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/breakable_text" rel="alternate"/>
</entry>
<entry>
<title>cisco_cdr</title>
<id>https://localhost:8089/services/properties/props/cisco_cdr</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/cisco_cdr" rel="alternate"/>
</entry>
<entry>
<title>cisco_syslog</title>
<id>https://localhost:8089/services/properties/props/cisco_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/cisco_syslog" rel="alternate"/>
</entry>
<entry>
<title>clavister</title>
<id>https://localhost:8089/services/properties/props/clavister</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/clavister" rel="alternate"/>
</entry>
<entry>
<title>csv</title>
<id>https://localhost:8089/services/properties/props/csv</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/csv" rel="alternate"/>
</entry>
<entry>
<title>cups_access</title>
<id>https://localhost:8089/services/properties/props/cups_access</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/cups_access" rel="alternate"/>
</entry>
<entry>
<title>cups_error</title>
<id>https://localhost:8089/services/properties/props/cups_error</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/cups_error" rel="alternate"/>
</entry>
<entry>
<title>db2_diag</title>
<id>https://localhost:8089/services/properties/props/db2_diag</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/db2_diag" rel="alternate"/>
</entry>
<entry>
<title>default</title>
<id>https://localhost:8089/services/properties/props/default</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/default" rel="alternate"/>
</entry>
<entry>
<title>delayedrule::breakable_text</title>
<id>https://localhost:8089/services/properties/props/delayedrule%3A%3Abreakable_text</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/delayedrule%3A%3Abreakable_text" rel="alternate"/>
</entry>
<entry>
<title>delayedrule::syslog</title>
<id>https://localhost:8089/services/properties/props/delayedrule%3A%3Asyslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/delayedrule%3A%3Asyslog" rel="alternate"/>
</entry>
<entry>
<title>dmesg</title>
<id>https://localhost:8089/services/properties/props/dmesg</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/dmesg" rel="alternate"/>
</entry>
<entry>
<title>exchange</title>
<id>https://localhost:8089/services/properties/props/exchange</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/exchange" rel="alternate"/>
</entry>
<entry>
<title>exim_main</title>
<id>https://localhost:8089/services/properties/props/exim_main</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/exim_main" rel="alternate"/>
</entry>
<entry>
<title>exim_reject</title>
<id>https://localhost:8089/services/properties/props/exim_reject</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/exim_reject" rel="alternate"/>
</entry>
<entry>
<title>fileTrackerCrcLog</title>
<id>https://localhost:8089/services/properties/props/fileTrackerCrcLog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/fileTrackerCrcLog" rel="alternate"/>
</entry>
<entry>
<title>fs_notification</title>
<id>https://localhost:8089/services/properties/props/fs_notification</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/fs_notification" rel="alternate"/>
</entry>
<entry>
<title>ftp</title>
<id>https://localhost:8089/services/properties/props/ftp</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/ftp" rel="alternate"/>
</entry>
<entry>
<title>ignored_type</title>
<id>https://localhost:8089/services/properties/props/ignored_type</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/ignored_type" rel="alternate"/>
</entry>
<entry>
<title>iis</title>
<id>https://localhost:8089/services/properties/props/iis</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/iis" rel="alternate"/>
</entry>
<entry>
<title>known_binary</title>
<id>https://localhost:8089/services/properties/props/known_binary</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/known_binary" rel="alternate"/>
</entry>
<entry>
<title>lastlog</title>
<id>https://localhost:8089/services/properties/props/lastlog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/lastlog" rel="alternate"/>
</entry>
<entry>
<title>license_usage-too_small</title>
<id>https://localhost:8089/services/properties/props/license_usage-too_small</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/license_usage-too_small" rel="alternate"/>
</entry>
<entry>
<title>linux_audit</title>
<id>https://localhost:8089/services/properties/props/linux_audit</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/linux_audit" rel="alternate"/>
</entry>
<entry>
<title>linux_bootlog</title>
<id>https://localhost:8089/services/properties/props/linux_bootlog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/linux_bootlog" rel="alternate"/>
</entry>
<entry>
<title>linux_messages_syslog</title>
<id>https://localhost:8089/services/properties/props/linux_messages_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/linux_messages_syslog" rel="alternate"/>
</entry>
<entry>
<title>linux_secure</title>
<id>https://localhost:8089/services/properties/props/linux_secure</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/linux_secure" rel="alternate"/>
</entry>
<entry>
<title>log4j</title>
<id>https://localhost:8089/services/properties/props/log4j</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/log4j" rel="alternate"/>
</entry>
<entry>
<title>log4php</title>
<id>https://localhost:8089/services/properties/props/log4php</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/log4php" rel="alternate"/>
</entry>
<entry>
<title>manpage</title>
<id>https://localhost:8089/services/properties/props/manpage</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/manpage" rel="alternate"/>
</entry>
<entry>
<title>misc_text</title>
<id>https://localhost:8089/services/properties/props/misc_text</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/misc_text" rel="alternate"/>
</entry>
<entry>
<title>mysqld</title>
<id>https://localhost:8089/services/properties/props/mysqld</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/mysqld" rel="alternate"/>
</entry>
<entry>
<title>mysqld_bin</title>
<id>https://localhost:8089/services/properties/props/mysqld_bin</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/mysqld_bin" rel="alternate"/>
</entry>
<entry>
<title>mysqld_error</title>
<id>https://localhost:8089/services/properties/props/mysqld_error</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/mysqld_error" rel="alternate"/>
</entry>
<entry>
<title>novell_groupwise</title>
<id>https://localhost:8089/services/properties/props/novell_groupwise</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/novell_groupwise" rel="alternate"/>
</entry>
<entry>
<title>osx_asl</title>
<id>https://localhost:8089/services/properties/props/osx_asl</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_asl" rel="alternate"/>
</entry>
<entry>
<title>osx_crash_log</title>
<id>https://localhost:8089/services/properties/props/osx_crash_log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_crash_log" rel="alternate"/>
</entry>
<entry>
<title>osx_crashreporter</title>
<id>https://localhost:8089/services/properties/props/osx_crashreporter</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_crashreporter" rel="alternate"/>
</entry>
<entry>
<title>osx_daily</title>
<id>https://localhost:8089/services/properties/props/osx_daily</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_daily" rel="alternate"/>
</entry>
<entry>
<title>osx_install</title>
<id>https://localhost:8089/services/properties/props/osx_install</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_install" rel="alternate"/>
</entry>
<entry>
<title>osx_monthly</title>
<id>https://localhost:8089/services/properties/props/osx_monthly</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_monthly" rel="alternate"/>
</entry>
<entry>
<title>osx_secure</title>
<id>https://localhost:8089/services/properties/props/osx_secure</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_secure" rel="alternate"/>
</entry>
<entry>
<title>osx_weekly</title>
<id>https://localhost:8089/services/properties/props/osx_weekly</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_weekly" rel="alternate"/>
</entry>
<entry>
<title>osx_window_server</title>
<id>https://localhost:8089/services/properties/props/osx_window_server</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/osx_window_server" rel="alternate"/>
</entry>
<entry>
<title>postfix_syslog</title>
<id>https://localhost:8089/services/properties/props/postfix_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/postfix_syslog" rel="alternate"/>
</entry>
<entry>
<title>preprocess-Z</title>
<id>https://localhost:8089/services/properties/props/preprocess-Z</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/preprocess-Z" rel="alternate"/>
</entry>
<entry>
<title>preprocess-bzip</title>
<id>https://localhost:8089/services/properties/props/preprocess-bzip</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/preprocess-bzip" rel="alternate"/>
</entry>
<entry>
<title>preprocess-gzip</title>
<id>https://localhost:8089/services/properties/props/preprocess-gzip</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/preprocess-gzip" rel="alternate"/>
</entry>
<entry>
<title>preprocess-tar</title>
<id>https://localhost:8089/services/properties/props/preprocess-tar</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/preprocess-tar" rel="alternate"/>
</entry>
<entry>
<title>preprocess-targz</title>
<id>https://localhost:8089/services/properties/props/preprocess-targz</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/preprocess-targz" rel="alternate"/>
</entry>
<entry>
<title>preprocess-zip</title>
<id>https://localhost:8089/services/properties/props/preprocess-zip</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/preprocess-zip" rel="alternate"/>
</entry>
<entry>
<title>procmail</title>
<id>https://localhost:8089/services/properties/props/procmail</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/procmail" rel="alternate"/>
</entry>
<entry>
<title>rpmpkgs</title>
<id>https://localhost:8089/services/properties/props/rpmpkgs</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rpmpkgs" rel="alternate"/>
</entry>
<entry>
<title>rule::access_combined</title>
<id>https://localhost:8089/services/properties/props/rule%3A%3Aaccess_combined</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rule%3A%3Aaccess_combined" rel="alternate"/>
</entry>
<entry>
<title>rule::access_combined_wcookie</title>
<id>https://localhost:8089/services/properties/props/rule%3A%3Aaccess_combined_wcookie</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rule%3A%3Aaccess_combined_wcookie" rel="alternate"/>
</entry>
<entry>
<title>rule::access_common</title>
<id>https://localhost:8089/services/properties/props/rule%3A%3Aaccess_common</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rule%3A%3Aaccess_common" rel="alternate"/>
</entry>
<entry>
<title>rule::exim_main</title>
<id>https://localhost:8089/services/properties/props/rule%3A%3Aexim_main</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rule%3A%3Aexim_main" rel="alternate"/>
</entry>
<entry>
<title>rule::postfix_syslog</title>
<id>https://localhost:8089/services/properties/props/rule%3A%3Apostfix_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rule%3A%3Apostfix_syslog" rel="alternate"/>
</entry>
<entry>
<title>rule::sendmail_syslog</title>
<id>https://localhost:8089/services/properties/props/rule%3A%3Asendmail_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rule%3A%3Asendmail_syslog" rel="alternate"/>
</entry>
<entry>
<title>rule::snort</title>
<id>https://localhost:8089/services/properties/props/rule%3A%3Asnort</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/rule%3A%3Asnort" rel="alternate"/>
</entry>
<entry>
<title>sar</title>
<id>https://localhost:8089/services/properties/props/sar</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/sar" rel="alternate"/>
</entry>
<entry>
<title>sendmail_syslog</title>
<id>https://localhost:8089/services/properties/props/sendmail_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/sendmail_syslog" rel="alternate"/>
</entry>
<entry>
<title>snort</title>
<id>https://localhost:8089/services/properties/props/snort</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/snort" rel="alternate"/>
</entry>
<entry>
<title>source::...((.(bak|old))|,v|~|#)</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%28%28.%28bak%7Cold%29%29%7C%2Cv%7C~%7C%23%29</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%28%28.%28bak%7Cold%29%29%7C%2Cv%7C~%7C%23%29" rel="alternate"/>
</entry>
<entry>
<title>source::....(0t|a|ali|asa|au|bmp|cg|cgi|class|d|dat|deb|del|dot|dvi|dylib|elc|eps|exe|ftn|gif|hlp|hqx|hs|icns|ico|inc|iso|jame|jin|jpeg|jpg|kml|la|lhs|lib|lo|lock|mcp|mid|mp3|mpg|msf|nib|o|obj|odt|ogg|ook|opt|os|pal|pbm|pdf|pem|pgm|plo|png|po|pod|pp|ppd|ppm|ppt|prc|ps|psd|psym|pyc|pyd|rast|rb|rde|rdf|rdr|rgb|ro|rpm|rsrc|so|ss|stg|strings|tdt|tif|tiff|tk|uue|vhd|xbm|xlb|xls|xlw)</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....%280t%7Ca%7Cali%7Casa%7Cau%7Cbmp%7Ccg%7Ccgi%7Cclass%7Cd%7Cdat%7Cdeb%7Cdel%7Cdot%7Cdvi%7Cdylib%7Celc%7Ceps%7Cexe%7Cftn%7Cgif%7Chlp%7Chqx%7Chs%7Cicns%7Cico%7Cinc%7Ciso%7Cjame%7Cjin%7Cjpeg%7Cjpg%7Ckml%7Cla%7Clhs%7Clib%7Clo%7Clock%7Cmcp%7Cmid%7Cmp3%7Cmpg%7Cmsf%7Cnib%7Co%7Cobj%7Codt%7Cogg%7Cook%7Copt%7Cos%7Cpal%7Cpbm%7Cpdf%7Cpem%7Cpgm%7Cplo%7Cpng%7Cpo%7Cpod%7Cpp%7Cppd%7Cppm%7Cppt%7Cprc%7Cps%7Cpsd%7Cpsym%7Cpyc%7Cpyd%7Crast%7Crb%7Crde%7Crdf%7Crdr%7Crgb%7Cro%7Crpm%7Crsrc%7Cso%7Css%7Cstg%7Cstrings%7Ctdt%7Ctif%7Ctiff%7Ctk%7Cuue%7Cvhd%7Cxbm%7Cxlb%7Cxls%7Cxlw%29</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....%280t%7Ca%7Cali%7Casa%7Cau%7Cbmp%7Ccg%7Ccgi%7Cclass%7Cd%7Cdat%7Cdeb%7Cdel%7Cdot%7Cdvi%7Cdylib%7Celc%7Ceps%7Cexe%7Cftn%7Cgif%7Chlp%7Chqx%7Chs%7Cicns%7Cico%7Cinc%7Ciso%7Cjame%7Cjin%7Cjpeg%7Cjpg%7Ckml%7Cla%7Clhs%7Clib%7Clo%7Clock%7Cmcp%7Cmid%7Cmp3%7Cmpg%7Cmsf%7Cnib%7Co%7Cobj%7Codt%7Cogg%7Cook%7Copt%7Cos%7Cpal%7Cpbm%7Cpdf%7Cpem%7Cpgm%7Cplo%7Cpng%7Cpo%7Cpod%7Cpp%7Cppd%7Cppm%7Cppt%7Cprc%7Cps%7Cpsd%7Cpsym%7Cpyc%7Cpyd%7Crast%7Crb%7Crde%7Crdf%7Crdr%7Crgb%7Cro%7Crpm%7Crsrc%7Cso%7Css%7Cstg%7Cstrings%7Ctdt%7Ctif%7Ctiff%7Ctk%7Cuue%7Cvhd%7Cxbm%7Cxlb%7Cxls%7Cxlw%29" rel="alternate"/>
</entry>
<entry>
<title>source::....(?<!tar.)gz(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....%28%3F%3C%21tar.%29gz%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....%28%3F%3C%21tar.%29gz%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::....(cache|class|cxx|dylib|jar|lo|xslt|md5|rpm|deb|iso|vim)</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....%28cache%7Cclass%7Ccxx%7Cdylib%7Cjar%7Clo%7Cxslt%7Cmd5%7Crpm%7Cdeb%7Ciso%7Cvim%29</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....%28cache%7Cclass%7Ccxx%7Cdylib%7Cjar%7Clo%7Cxslt%7Cmd5%7Crpm%7Cdeb%7Ciso%7Cvim%29" rel="alternate"/>
</entry>
<entry>
<title>source::....(css|htm|html|sgml|shtml|template)</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....%28css%7Chtm%7Chtml%7Csgml%7Cshtml%7Ctemplate%29</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....%28css%7Chtm%7Chtml%7Csgml%7Cshtml%7Ctemplate%29" rel="alternate"/>
</entry>
<entry>
<title>source::....(jar)(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....%28jar%29%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....%28jar%29%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::....(tar.gz|tgz)(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....%28tar.gz%7Ctgz%29%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....%28tar.gz%7Ctgz%29%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::....(tbz|tbz2)(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....%28tbz%7Ctbz2%29%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....%28tbz%7Ctbz2%29%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::....Z(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....Z%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....Z%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::....bz2?(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....bz2%3F%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....bz2%3F%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::....crash.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....crash.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....crash.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::....csv</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....csv</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....csv" rel="alternate"/>
</entry>
<entry>
<title>source::....tar(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A....tar%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A....tar%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../(apache|httpd).../error*</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2F%28apache%7Chttpd%29...%2Ferror%2A</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2F%28apache%7Chttpd%29...%2Ferror%2A" rel="alternate"/>
</entry>
<entry>
<title>source::.../(ex|in|nc)(\d{4,8})*?.log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2F%28ex%7Cin%7Cnc%29%28%5Cd%7B4%2C8%7D%29%2A%3F.log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2F%28ex%7Cin%7Cnc%29%28%5Cd%7B4%2C8%7D%29%2A%3F.log" rel="alternate"/>
</entry>
<entry>
<title>source::.../(readme|README)...</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2F%28readme%7CREADME%29...</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2F%28readme%7CREADME%29..." rel="alternate"/>
</entry>
<entry>
<title>source::.../man/man\d+/*.\d+</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fman%2Fman%5Cd%2B%2F%2A.%5Cd%2B</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fman%2Fman%5Cd%2B%2F%2A.%5Cd%2B" rel="alternate"/>
</entry>
<entry>
<title>source::.../messages(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fmessages%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fmessages%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../mysql.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fmysql.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fmysql.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../private/var/log/mail.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fprivate%2Fvar%2Flog%2Fmail.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fprivate%2Fvar%2Flog%2Fmail.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../private/var/log/system.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fprivate%2Fvar%2Flog%2Fsystem.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fprivate%2Fvar%2Flog%2Fsystem.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../private/var/log/windowserver.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fprivate%2Fvar%2Flog%2Fwindowserver.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fprivate%2Fvar%2Flog%2Fwindowserver.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../procmail(_|.)log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fprocmail%28_%7C.%29log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fprocmail%28_%7C.%29log" rel="alternate"/>
</entry>
<entry>
<title>source::.../splunkd.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fsplunkd.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fsplunkd.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../splunkd_access.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fsplunkd_access.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fsplunkd_access.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../syslog(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fsyslog%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fsyslog%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/anaconda.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fanaconda.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fanaconda.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/anaconda.syslog(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fanaconda.syslog%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fanaconda.syslog%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/asl.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fasl.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fasl.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/audit/audit.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Faudit%2Faudit.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Faudit%2Faudit.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/boot.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fboot.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fboot.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/crashreporter.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fcrashreporter.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fcrashreporter.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/cups/access_log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fcups%2Faccess_log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fcups%2Faccess_log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/cups/error_log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fcups%2Ferror_log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fcups%2Ferror_log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/daily.out(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fdaily.out%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fdaily.out%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/dmesg(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fdmesg%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fdmesg%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/ftp.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fftp.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fftp.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/httpd/error_log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fhttpd%2Ferror_log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fhttpd%2Ferror_log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/httpd/httpd/ssl_error_log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fhttpd%2Fhttpd%2Fssl_error_log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fhttpd%2Fhttpd%2Fssl_error_log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/install.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Finstall.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Finstall.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/lastlog(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Flastlog%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Flastlog%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/monthly.out(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fmonthly.out%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fmonthly.out%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/rpmpkgs(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Frpmpkgs%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Frpmpkgs%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/sa/sar\d+</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsa%2Fsar%5Cd%2B</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsa%2Fsar%5Cd%2B" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/secure(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsecure%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsecure%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/secure.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsecure.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsecure.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/(web|report)_access.log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28web%7Creport%29_access.log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28web%7Creport%29_access.log" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/(web|report)_service.log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28web%7Creport%29_service.log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28web%7Creport%29_service.log" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/audit.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Faudit.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Faudit.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/btool.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fbtool.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fbtool.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/crash-*.log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fcrash-%2A.log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fcrash-%2A.log" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/intentions.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fintentions.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fintentions.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/license_audit.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Flicense_audit.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Flicense_audit.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/metrics.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fmetrics.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fmetrics.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/python.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fpython.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fpython.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/scheduler.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fscheduler.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fscheduler.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/searches.log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsearches.log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsearches.log" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/searchhistory.log(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsearchhistory.log%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsearchhistory.log%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/splunk_stdout.log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsplunk_stdout.log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsplunk_stdout.log" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/splunk/splunkd_stderr.log</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsplunkd_stderr.log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2Fsplunkd_stderr.log" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/spooler(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fspooler%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fspooler%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/weekly.out(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fweekly.out%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fweekly.out%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::.../var/log/wtmp(.\d+)?</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fwtmp%28.%5Cd%2B%29%3F</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fwtmp%28.%5Cd%2B%29%3F" rel="alternate"/>
</entry>
<entry>
<title>source::...stash</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...stash</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...stash" rel="alternate"/>
</entry>
<entry>
<title>source::...stash_new</title>
<id>https://localhost:8089/services/properties/props/source%3A%3A...stash_new</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3A...stash_new" rel="alternate"/>
</entry>
<entry>
<title>source::WMI...</title>
<id>https://localhost:8089/services/properties/props/source%3A%3AWMI...</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3AWMI..." rel="alternate"/>
</entry>
<entry>
<title>source::WinEventLog...</title>
<id>https://localhost:8089/services/properties/props/source%3A%3AWinEventLog...</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source%3A%3AWinEventLog..." rel="alternate"/>
</entry>
<entry>
<title>source_archive</title>
<id>https://localhost:8089/services/properties/props/source_archive</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/source_archive" rel="alternate"/>
</entry>
<entry>
<title>splunk-blocksignature</title>
<id>https://localhost:8089/services/properties/props/splunk-blocksignature</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk-blocksignature" rel="alternate"/>
</entry>
<entry>
<title>splunk_com_php_error</title>
<id>https://localhost:8089/services/properties/props/splunk_com_php_error</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk_com_php_error" rel="alternate"/>
</entry>
<entry>
<title>splunk_directory_monitor</title>
<id>https://localhost:8089/services/properties/props/splunk_directory_monitor</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk_directory_monitor" rel="alternate"/>
</entry>
<entry>
<title>splunk_directory_monitor_misc</title>
<id>https://localhost:8089/services/properties/props/splunk_directory_monitor_misc</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk_directory_monitor_misc" rel="alternate"/>
</entry>
<entry>
<title>splunk_help</title>
<id>https://localhost:8089/services/properties/props/splunk_help</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk_help" rel="alternate"/>
</entry>
<entry>
<title>splunk_search_history</title>
<id>https://localhost:8089/services/properties/props/splunk_search_history</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk_search_history" rel="alternate"/>
</entry>
<entry>
<title>splunk_web_access</title>
<id>https://localhost:8089/services/properties/props/splunk_web_access</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk_web_access" rel="alternate"/>
</entry>
<entry>
<title>splunk_web_service</title>
<id>https://localhost:8089/services/properties/props/splunk_web_service</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunk_web_service" rel="alternate"/>
</entry>
<entry>
<title>splunkd</title>
<id>https://localhost:8089/services/properties/props/splunkd</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunkd" rel="alternate"/>
</entry>
<entry>
<title>splunkd_access</title>
<id>https://localhost:8089/services/properties/props/splunkd_access</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunkd_access" rel="alternate"/>
</entry>
<entry>
<title>splunkd_crash_log</title>
<id>https://localhost:8089/services/properties/props/splunkd_crash_log</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunkd_crash_log" rel="alternate"/>
</entry>
<entry>
<title>splunkd_misc</title>
<id>https://localhost:8089/services/properties/props/splunkd_misc</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunkd_misc" rel="alternate"/>
</entry>
<entry>
<title>splunkd_stderr</title>
<id>https://localhost:8089/services/properties/props/splunkd_stderr</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunkd_stderr" rel="alternate"/>
</entry>
<entry>
<title>splunkd_stdout-too_small</title>
<id>https://localhost:8089/services/properties/props/splunkd_stdout-too_small</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/splunkd_stdout-too_small" rel="alternate"/>
</entry>
<entry>
<title>spooler</title>
<id>https://localhost:8089/services/properties/props/spooler</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/spooler" rel="alternate"/>
</entry>
<entry>
<title>ssl_error</title>
<id>https://localhost:8089/services/properties/props/ssl_error</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/ssl_error" rel="alternate"/>
</entry>
<entry>
<title>stash</title>
<id>https://localhost:8089/services/properties/props/stash</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/stash" rel="alternate"/>
</entry>
<entry>
<title>stash_new</title>
<id>https://localhost:8089/services/properties/props/stash_new</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/stash_new" rel="alternate"/>
</entry>
<entry>
<title>syslog</title>
<id>https://localhost:8089/services/properties/props/syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/syslog" rel="alternate"/>
</entry>
<entry>
<title>tcp</title>
<id>https://localhost:8089/services/properties/props/tcp</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/tcp" rel="alternate"/>
</entry>
<entry>
<title>too_small</title>
<id>https://localhost:8089/services/properties/props/too_small</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/too_small" rel="alternate"/>
</entry>
<entry>
<title>web</title>
<id>https://localhost:8089/services/properties/props/web</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/web" rel="alternate"/>
</entry>
<entry>
<title>weblogic_stdout</title>
<id>https://localhost:8089/services/properties/props/weblogic_stdout</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/weblogic_stdout" rel="alternate"/>
</entry>
<entry>
<title>websphere_activity</title>
<id>https://localhost:8089/services/properties/props/websphere_activity</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/websphere_activity" rel="alternate"/>
</entry>
<entry>
<title>websphere_core</title>
<id>https://localhost:8089/services/properties/props/websphere_core</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/websphere_core" rel="alternate"/>
</entry>
<entry>
<title>websphere_trlog</title>
<id>https://localhost:8089/services/properties/props/websphere_trlog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/websphere_trlog" rel="alternate"/>
</entry>
<entry>
<title>windows_snare_syslog</title>
<id>https://localhost:8089/services/properties/props/windows_snare_syslog</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/windows_snare_syslog" rel="alternate"/>
</entry>
<entry>
<title>wmi</title>
<id>https://localhost:8089/services/properties/props/wmi</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/wmi" rel="alternate"/>
</entry>
<entry>
<title>wtmp</title>
<id>https://localhost:8089/services/properties/props/wtmp</id>
<updated>2011-07-08T11:53:58-07:00</updated>
<link href="/services/properties/props/wtmp" rel="alternate"/>
</entry>
</feed>
POST properties/{file_name}
Creates a new stanza in the configuratin file specified by {name}.
Request
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| __stanza | String | | The name of the stanza to create.
Note: Double underscore before stanza. |
Response Codes
| Status Code | Description |
|---|---|
| 201 | Stanza created successfully. |
| 303 | Stanza already exists. |
| 400 | Request error. See response body for details. |
Returned Values
No values returned for this request.
Example
Creates a stanza named proxylogs in props.conf.
curl -k -u admin:pass https://localhost:8089/services/properties/props \ -d __stanza=proxylogs
No XML response.
properties/{file_name}/{stanza_name}
GET properties/{file_name}/{stanza_name}
Returns the configuration values for the stanza represented by {stanza_name} in the configuration file specified by {file_name}.
Request
No parameters for this request.
Response Codes
| Status Code | Description |
|---|---|
| 200 | Listed successfully. |
| 404 | Stanza does not exist. |
Returned Values
No values returned for this request.
Example
Retrieves the stanza named proxylogs from props.conf.
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs
<feed xmlns="http://www.w3.org/2005/Atom"
xmlns:s="http://dev.splunk.com/ns/rest">
<title>proxylogs</title>
<id>https://localhost:8089/services/properties/props/proxylogs</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<generator version="102807"/>
<author>
<name>Splunk</name>
</author>
<entry>
<title>ANNOTATE_PUNCT</title>
<id>https://localhost:8089/services/properties/props/proxylogs/ANNOTATE_PUNCT</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/ANNOTATE_PUNCT" rel="alternate"/>
<content type="text">True</content>
</entry>
<entry>
<title>BREAK_ONLY_BEFORE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/BREAK_ONLY_BEFORE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/BREAK_ONLY_BEFORE" rel="alternate"/>
<content type="text"/>
</entry>
<entry>
<title>BREAK_ONLY_BEFORE_DATE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/BREAK_ONLY_BEFORE_DATE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/BREAK_ONLY_BEFORE_DATE" rel="alternate"/>
<content type="text">True</content>
</entry>
<entry>
<title>CHARSET</title>
<id>https://localhost:8089/services/properties/props/proxylogs/CHARSET</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/CHARSET" rel="alternate"/>
<content type="text">UTF-8</content>
</entry>
<entry>
<title>DATETIME_CONFIG</title>
<id>https://localhost:8089/services/properties/props/proxylogs/DATETIME_CONFIG</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/DATETIME_CONFIG" rel="alternate"/>
<content type="text">/etc/datetime.xml</content>
</entry>
<entry>
<title>HEADER_MODE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/HEADER_MODE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/HEADER_MODE" rel="alternate"/>
<content type="text"/>
</entry>
<entry>
<title>LEARN_SOURCETYPE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/LEARN_SOURCETYPE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/LEARN_SOURCETYPE" rel="alternate"/>
<content type="text">true</content>
</entry>
<entry>
<title>LINE_BREAKER_LOOKBEHIND</title>
<id>https://localhost:8089/services/properties/props/proxylogs/LINE_BREAKER_LOOKBEHIND</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/LINE_BREAKER_LOOKBEHIND" rel="alternate"/>
<content type="text">100</content>
</entry>
<entry>
<title>MAX_DAYS_AGO</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MAX_DAYS_AGO</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MAX_DAYS_AGO" rel="alternate"/>
<content type="text">2000</content>
</entry>
<entry>
<title>MAX_DAYS_HENCE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MAX_DAYS_HENCE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MAX_DAYS_HENCE" rel="alternate"/>
<content type="text">2</content>
</entry>
<entry>
<title>MAX_DIFF_SECS_AGO</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MAX_DIFF_SECS_AGO</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MAX_DIFF_SECS_AGO" rel="alternate"/>
<content type="text">3600</content>
</entry>
<entry>
<title>MAX_DIFF_SECS_HENCE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MAX_DIFF_SECS_HENCE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MAX_DIFF_SECS_HENCE" rel="alternate"/>
<content type="text">604800</content>
</entry>
<entry>
<title>MAX_EVENTS</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MAX_EVENTS</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MAX_EVENTS" rel="alternate"/>
<content type="text">256</content>
</entry>
<entry>
<title>MAX_TIMESTAMP_LOOKAHEAD</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MAX_TIMESTAMP_LOOKAHEAD</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MAX_TIMESTAMP_LOOKAHEAD" rel="alternate"/>
<content type="text">128</content>
</entry>
<entry>
<title>MUST_BREAK_AFTER</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MUST_BREAK_AFTER</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MUST_BREAK_AFTER" rel="alternate"/>
<content type="text"/>
</entry>
<entry>
<title>MUST_NOT_BREAK_AFTER</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MUST_NOT_BREAK_AFTER</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MUST_NOT_BREAK_AFTER" rel="alternate"/>
<content type="text"/>
</entry>
<entry>
<title>MUST_NOT_BREAK_BEFORE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/MUST_NOT_BREAK_BEFORE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/MUST_NOT_BREAK_BEFORE" rel="alternate"/>
<content type="text"/>
</entry>
<entry>
<title>SEGMENTATION</title>
<id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/SEGMENTATION" rel="alternate"/>
<content type="text">indexing</content>
</entry>
<entry>
<title>SEGMENTATION-all</title>
<id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-all</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/SEGMENTATION-all" rel="alternate"/>
<content type="text">full</content>
</entry>
<entry>
<title>SEGMENTATION-inner</title>
<id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-inner</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/SEGMENTATION-inner" rel="alternate"/>
<content type="text">inner</content>
</entry>
<entry>
<title>SEGMENTATION-outer</title>
<id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-outer</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/SEGMENTATION-outer" rel="alternate"/>
<content type="text">outer</content>
</entry>
<entry>
<title>SEGMENTATION-raw</title>
<id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-raw</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/SEGMENTATION-raw" rel="alternate"/>
<content type="text">none</content>
</entry>
<entry>
<title>SEGMENTATION-standard</title>
<id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-standard</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/SEGMENTATION-standard" rel="alternate"/>
<content type="text">standard</content>
</entry>
<entry>
<title>SHOULD_LINEMERGE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/SHOULD_LINEMERGE" rel="alternate"/>
<content type="text">True</content>
</entry>
<entry>
<title>TRANSFORMS</title>
<id>https://localhost:8089/services/properties/props/proxylogs/TRANSFORMS</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/TRANSFORMS" rel="alternate"/>
<content type="text"/>
</entry>
<entry>
<title>TRUNCATE</title>
<id>https://localhost:8089/services/properties/props/proxylogs/TRUNCATE</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/TRUNCATE" rel="alternate"/>
<content type="text">10000</content>
</entry>
<entry>
<title>maxDist</title>
<id>https://localhost:8089/services/properties/props/proxylogs/maxDist</id>
<updated>2011-07-08T12:08:52-07:00</updated>
<link href="/services/properties/props/proxylogs/maxDist" rel="alternate"/>
<content type="text">100</content>
</entry>
</feed>
POST properties/{file_name}/{stanza_name}
Adds or updates key/value pairs in the specified stanza. One or more key/value pairs may be passed at one time to this endpoint.
Request
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| <key_name> | String | | Specifies a key/value pair to update. |
Response Codes
| Status Code | Description |
|---|---|
| 200 | Updated successfully. |
| 400 | Request error. See response body for details. |
| 404 | Stanza does not exist. |
| 409 | Request error: this operation is invalid for this item. See returned XML for explanation. |
Returned Values
No values returned for this request.
Example
Modifies two settings at once for the proxylogs sourcetype in props.conf.
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs \ -d NO_BINARY_CHECK=true \ -d CHARSET=UTF-8
<response>
<messages>
<msg type="INFO">Successfully modified 2 key(s)</msg>
</messages>
</response>
properties/{file_name}/{stanza_name}/{key_name}
GET properties/{file_name}/{stanza_name}/{key_name}
Returns the value of the key in plain text for specified stanza and configuration file.
Request
No parameters for this request.
Response Codes
| Status Code | Description |
|---|---|
| 200 | Listed successfully. |
| 404 | Key in the stanza does not exist. |
Returned Values
No values returned for this request.
Example
Retreive the raw value (not XML) of the SHOULD_LINEMERGE setting from the proxylogs stanza in props.conf.
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE
True
POST properties/{file_name}/{stanza_name}/{key_name}
Update an existing key value.
Request
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| value | String | | The value to set for the named key in this named stanza in the named configuration file. |
Response Codes
| Status Code | Description |
|---|---|
| 200 | Updated successfully. |
| 400 | Request error. See response body for details. |
| 404 | Key does not exist in the stanza. |
| 409 | Request error: this operation is invalid for this item. See returned XML for explanation. |
Returned Values
No values returned for this request.
Example
Disables line merging for the proxylogs sourcetype in props.conf.
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE \ -d value=false
<response>
<messages>
<msg type="INFO">Successfully modified 1 key(s)</msg>
</messages>
</response>
This documentation applies to the following versions of Splunk: 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.