Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Cluster endpoint descriptions

Manage master and peer cluster nodes.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

Splunk Cloud limitations

If you have a managed Splunk Cloud deployment with search head clustering and index clustering, the REST API supports access to the search head only. You can use the REST API to interact with the search head in your deployment. Using the REST API to access any other cluster member nodes is not supported. For example, index cluster management endpoints are not applicable to Splunk Cloud deployments.

Authorized users can access and configure other cluster members, including indexer, cluster master, and license master nodes, in the Splunk Cloud manager user interface. 


cluster/config

https://<host>:<mPort>/services/cluster/config

Access cluster node configuration details.


GET

List cluster node configuration.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Name Description
cxn_timeout Low-level timeout, in seconds, for establishing connection between cluster nodes. Defaults to 60 seconds.
disabled Indicates if this node is disabled.
forwarderdata_rcv_port The port from which to receive data from a forwarder.
forwarderdata_use_ssl Indicates whether to use SSL when receiving data from a forwarder.
heartbeat_period Only valid for peer nodes in a cluster. The time, in seconds, that a peer attempts to send a heartbeat to the master
heartbeat_timeout Only valid for the master node in a cluster configuration. The time, in seconds, before a master considers a peer down. Once a peer is down, the master initiates steps to replicate buckets from the dead peer to its live peers. Defaults to 60 seconds.
master_uri Valid only for nodes configured as a peer or searchhead.

URI of the cluster master to which this node connects.

max_peer_build_load The number of jobs that a peer can have in progress at any time that make the bucket searchable.
max_peer_rep_load Maximum number of replications that can be ongoing as a target.
mode Valid values: (master | slave | searchhead | disabled) Defaults to disabled.

Sets operational mode for this cluster node. Only one master may exist per cluster.

ping_flag For internal use to facilitate communication between the master and peers.
quiet_period The time, in seconds, that a master waits for peers to add themselves to the cluster.
rcv_timeout Low-level timeout, in seconds, for receiving data between cluster nodes. Defaults to 60 seconds.
register_forwarder_address Not used.

Reserved for future use.

register_replication_address Valid only for nodes configured as peers. The address on which a peer is available for accepting replication data. This is useful in the cases where a peer host machine has multiple interfaces and only one of them can be reached by another splunkd instance.
register_search_address IP address that advertises this indexer to search heads.
rep_cxn_timeout Low-level timeout, in seconds, for establishing a connection for replicating data.
rep_max_rcv_timeout Maximum cumulative time, in seconds, for receiving acknowledgement data from peers. Defaults to 600s.
rep_max_send_timeout Maximum time, in seconds, for sending replication slice data between cluster nodes. Defaults to 600s.
rep_rcv_timeout Low-level timeout, in seconds, for receiving data between cluster nodes.
rep_send_timeout Low-level timeout, in seconds, for sending replication data between cluster nodes. Defaults to 5 seconds.
replication_factor Only valid for nodes configured as a master.

Determines how many copies of raw data are created in the cluster. This could be less than the number of cluster peers.

Must be greater than 0 and greater than or equal to the search factor. Defaults to 3.

replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
restart_timeout Only valid for nodes configured as a master. The amount of time, in seconds, the master waits for a peer to come back when the peer is restarted (to avoid the overhead of trying to fix the buckets that were on the peer). Defaults to 600 seconds.

Note: This only works if the peer is restarted from Splunk Web.

search_factor Only valid for nodes configured as a master. Determines how many searchable copies of each bucket to maintain. Must be less than or equal to replication_factor and greater than 0. Defaults to 2.
secret Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master.

Corresponds to pass4SymmKey setting in server.conf.

send_timeout Low-level timeout, in seconds, for sending data between cluster nodes. Defaults to 60 seconds.
summary_replication Boolean indicator of whether summary replication is on or off. A true value means that it is turned on.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/config

XML Response

<title>clusterconfig</title>
 <id>https://localhost:8089/services/cluster/config</id>
 <updated>2012-09-05T10:19:49-07:00</updated>
 <generator build="136169" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/config/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>config</title>
   <id>https://localhost:8089/services/cluster/config/config</id>
   <updated>2012-09-05T10:19:49-07:00</updated>
   <link href="/services/cluster/config/config" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/config/config" rel="list"/>
   <link href="/services/cluster/config/config/_reload" rel="_reload"/>
   <link href="/services/cluster/config/config" rel="edit"/>
   <link href="/services/cluster/config/config/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="cxn_timeout">60</s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
       <s:key name="forwarderdata_rcv_port">0</s:key>
       <s:key name="forwarderdata_use_ssl">1</s:key>
       <s:key name="heartbeat_period">1</s:key>
       <s:key name="heartbeat_timeout">60</s:key>
       <s:key name="master_uri"></s:key>
       <s:key name="max_peer_build_load">5</s:key>
       <s:key name="max_peer_rep_load">5</s:key>
       <s:key name="mode">master</s:key>
       <s:key name="ping_flag">1</s:key>
       <s:key name="quiet_period">60</s:key>
       <s:key name="rcv_timeout">60</s:key>
       <s:key name="register_forwarder_address"></s:key>
       <s:key name="register_replication_address"></s:key>
       <s:key name="register_search_address"></s:key>
       <s:key name="rep_cxn_timeout">5</s:key>
       <s:key name="rep_max_rcv_timeout">600</s:key>
       <s:key name="rep_max_send_timeout">600</s:key>
       <s:key name="rep_rcv_timeout">10</s:key>
       <s:key name="rep_send_timeout">5</s:key>
       <s:key name="replication_factor">2</s:key>
       <s:key name="replication_port"></s:key>
       <s:key name="replication_use_ssl">0</s:key>
       <s:key name="restart_timeout">600</s:key>
       <s:key name="search_factor">2</s:key>
       <s:key name="secret">********</s:key>
       <s:key name="send_timeout">60</s:key>
     </s:dict>
   </content>
 </entry>

cluster/config/config

https://<host>:<mPort>/services/cluster/config/config

Manage cluster node configuration details.


GET

List cluster node configuration.

This operation works identically to the GET on cluster/config.


POST

Manage configuration details.


See Indexer cluster configuration overview in Managing Indexers and Clusters of Indexers and the [clustering] stanza options in the server.conf spec file for more details on indexer cluster configuration.

Request parameters

Name Datatype Description
available_sites N/A Sets the various sites that are recognized for this master. Valid values include site1 to site64.
cluster_label String Label for this cluster.
cxn_timeout Number Low-level timeout, in seconds, for establishing connection between cluster nodes. Defaults to 60 seconds.
forwarderdata_rcv_port Port number The port from which to receive data from a forwarder.
forwarderdata_use_ssl Boolean Indicates whether to use SSL when receiving data from a forwarder.
heartbeat_period Number Only valid for peer nodes in a cluster. Time, in seconds, that a peer attempts to send a heartbeat to the master
heartbeat_timeout Number Only valid for the master node in a cluster configuration. Time, in seconds, before a master considers a peer down. Once a peer is down, the master initiates steps to replicate buckets from the dead peer to its live peers. Defaults to 60 seconds.
master_uri URI Valid only for nodes configured as a peer or searchhead. URI of the cluster master to which this node connects.
max_peer_build_load Number The number of jobs that a peer can have in progress at any time that make the bucket searchable.
max_peer_rep_load Number Maximum number of replications that can be ongoing as a target.
mode See description. Required. Valid values: (master | slave | searchhead | disabled) Defaults to disabled. Sets operational mode for this cluster node. Only one master may exist per cluster.
multisite Boolean Enable or disable the multisite feature for this cluster.
notify_scan_period Non-zero number Controls the frequency that the indexer scans summary folders for summary updates. Only used when summary_replication is enabled on the Master. Defaults to 10 seconds.
ping_flag N/A For internal use to facilitate communication between the master and peers.
quiet_period Number The time, in seconds, that a master waits for peers to add themselves to the cluster.
rcv_timeout Number Low-level timeout, in seconds, for receiving data between cluster nodes. Defaults to 60 seconds.
register_forwarder_address N/A Reserved for future use.
register_replication_address See description. Valid only for nodes configured as peers. The address on which a peer is available for accepting replication data. This is useful in the cases where a peer host machine has multiple interfaces and only one of them can be reached by another splunkd instance.
register_search_address N/A IP address that advertises this indexer to search heads.
rep_cxn_timeout Number Low-level timeout, in seconds, for establishing a connection for replicating data.
rep_max_rcv_timeout Number Maximum cumulative time, in seconds, for receiving acknowledgement data from peers. Defaults to 600s.
rep_max_send_timeout Number Maximum time, in seconds, for sending replication slice data between cluster nodes. Defaults to 600s.
rep_rcv_timeout Number Low-level timeout, in seconds, for receiving data between cluster nodes.
rep_send_timeout Number Low-level timeout, in seconds, for sending replication data between cluster nodes. Defaults to 5 seconds.
replication_factor Number Only valid for nodes configured as a master. Determines how many copies of raw data are created in the cluster. This could be less than the number of cluster peers. Must be greater than 0 and greater than or equal to the search factor. Defaults to 3.
replication_port Number TCP port to listen for replicated data from another cluster member.
replication_use_ssl Number Indicates whether to use SSL when sending replication data.
restart_timeout Number Only valid for nodes configured as a master. The amount of time, in seconds, the master waits for a peer to come back when the peer is restarted (to avoid the overhead of trying to fix the buckets that were on the peer). Defaults to 600 seconds.

Note: This only works if the peer is restarted from Splunk Web.

search_factor Number Only valid for nodes configured as a master. Determines how many searchable copies of each bucket to maintain. Must be less than or equal to replication_factor and greater than 0. Defaults to 2.
secret N/A Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master. Corresponds to pass4SymmKey setting in server.conf.
send_timeout Number Low-level timeout, in seconds, for sending data between cluster nodes. Defaults to 60 seconds.
site N/A Site ID for slave/searchhead indexer. Valid values include site1 to site64.
site_replication_factor Number Replication factor for a multisite configuration.
site_search_factor Number Search factor for a multisite configuration.
summary_replication Boolean Enable or disable summary replication.
use_batch_mask_changes Boolean Only valid for mode=master .Specifies if the master should process bucket mask changes in

batch or inidividually one by one. Defaults to true. Set to false when there are 6.1 peers in the cluster for backwards compatibility.

Response data keys

None.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/config/config -d cxn_timeout=59

XML Response

  <title>clusterconfig</title>
  <id>https://localhost:8089/services/cluster/config</id>
  <updated>2015-12-07T17:09:48-08:00</updated>
  <generator build="917abedc8bb44ec1c225a6eb730808a606174cf0" version="20151123"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/config/_reload" rel="_reload"/>
  <link href="/services/cluster/config/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>

cluster/master/buckets

https://<host>:<mPort>/services/cluster/master/buckets

Provides bucket configuration information for a cluster master node.


GET

List cluster master node bucket configuration.


Request parameters
Use an &summaries=true field in the query string to show summaries.

Use one or more filters in the query string to select buckets or bucket states. For example, use this URL to filter buckets returned for both the main index and StreamingSource status.

https://localhost:8089/services/cluster/master/buckets?filter=index=main&filter=status=StreamingSource

See the following table for available filters.

Filter name Datatype Description
index String Index name.
status String Bucket state. Available options are
  • StreamingSource
  • StreamingTarget
  • Complete
  • StreamingError
  • PendingTruncate Bucket is scheduled to truncate.
  • PendingDiscard Bucket is scheduled to discard.
  • NonStreamingTarget
search_state String Bucket search state. Available options are
  • Searchable
  • Unsearchable
  • PendingSearchable Bucket scheduled to become searchable by transferring or building tsidx files.
  • PendingUnsearchable Bucket is scheduled to become unsearchable.
  • SearchablePendingMask Primary change is scheduled or in progress.
replication_count Number Use <, >, != or = with numbers to indicate filtering values.
search_count Number Use <, >, != or = with numbers to indicate filtering values.
bucket_size Number Use <, >, != or = with numbers to indicate filtering values.
frozen Boolean
1 | 0 or true | false
Return frozen buckets or non-frozen buckets.
has_primary Boolean
1 | 0 or true | false
Return buckets with primaries or without primaries.
meets_multisite_replication_count Boolean
1 | 0 or true | false
Return buckets that meet cluster replication policy or buckets that do not meet cluster replication policy.
meets_multisite_search_count Boolean
1 | 0 or true | false
Return buckets that meet cluster search policy or buckets that do not meet cluster search policy.
multisite_bucket Boolean
1 | 0 or true | false
Return buckets created in multisite mode or buckets not created in multisite mode.
origin_site String Site of the indexer where buckets were created.
standalone Boolean
1 | 0 or true | false
Use true or 1 to return standalone buckets. Use false or 0 to return clustered buckets.

Pagination and filtering parameters can be used with this method.

Returned values

Name Description
bucket_size Indicates the size, in bytes, of the bucket.
constrain_to_origin_site Flag indicating this particular bucket is a clustered pre-multisite bucket. Such buckets are replicated only within their origin site.
force_roll Flag indicating hot bucket needs to be force to roll by master. Usually when hot bucket does not have enough streaming targets to meet the policy.
frozen Indicates if the bucket is frozen.
index Name of the index to which the bucket belongs.
origin_site Where the bucket originated.
peers Lists information about buckets on peers to this master.
primaries_by_site Primary peer (GIUD).
rep_count_by_site Number of buckets.
search_count_by_site Number of searchable buckets.
service_after_time Bucket service is deferred until after this time.
standalone Indicates if the bucket was created on the peer before the peer entered into a cluster configuration with this master.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/buckets


XML Response

<title>clustermasterbuckets</title>
 <id>https://localhost:8089/services/cluster/master/buckets</id>
 <updated>2014-04-17T19:13:57+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/master/buckets/_new" rel="create"/>
 <opensearch:totalResults>24</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>_audit~0~238C3311-F0A4-4A9B-97F0-53667CFFEEAB</title>
   <id>https://localhost:8089/services/cluster/master/buckets/_audit~0~238C3311-F0A4-4A9B-97F0-53667CFFEEAB</id>
   <updated>2014-04-17T19:13:57+00:00</updated>
   <link href="/services/cluster/master/buckets/_audit~0~238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/buckets/_audit~0~238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="list"/>
   <link href="/services/cluster/master/buckets/_audit~0~238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="bucket_size">47187</s:key>
       <s:key name="constrain_to_origin_site">1</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="force_roll">0</s:key>
       <s:key name="frozen">0</s:key>
       <s:key name="index">_audit</s:key>
       <s:key name="origin_site">site2</s:key>
       <s:key name="peers">
         <s:dict>
           <s:key name="238C3311-F0A4-4A9B-97F0-53667CFFEEAB">
             <s:dict>
               <s:key name="bucket_flags">0x6</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Searchable</s:key>
               <s:key name="status">Complete</s:key>
             </s:dict>
           </s:key>
           <s:key name="C878FADC-513D-4BDD-BA48-F25BB82FE565">
             <s:dict>
               <s:key name="bucket_flags">0x0</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Searchable</s:key>
               <s:key name="status">Complete</s:key>
             </s:dict>
           </s:key>
           <s:key name="E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C">
             <s:dict>
               <s:key name="bucket_flags">0x0</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Unsearchable</s:key>
               <s:key name="status">Complete</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="primaries_by_site">
         <s:dict>
           <s:key name="site1">238C3311-F0A4-4A9B-97F0-53667CFFEEAB</s:key>
           <s:key name="site2">238C3311-F0A4-4A9B-97F0-53667CFFEEAB</s:key>
         </s:dict>
       </s:key>
       <s:key name="rep_count_by_site">
         <s:dict>
           <s:key name="site2">3</s:key>
         </s:dict>
       </s:key>
       <s:key name="search_count_by_site">
         <s:dict>
           <s:key name="site2">2</s:key>
         </s:dict>
       </s:key>
       <s:key name="service_after_time">0</s:key>
       <s:key name="standalone">0</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
     .
     .
     .
   elided
     .
     .
     .
 <entry>
   <title>_internal~1~E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C</title>
   <id>https://localhost:8089/services/cluster/master/buckets/_internal~1~E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C</id>
   <updated>2014-04-17T19:13:57+00:00</updated>
   <link href="/services/cluster/master/buckets/_internal~1~E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/buckets/_internal~1~E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C" rel="list"/>
   <link href="/services/cluster/master/buckets/_internal~1~E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="bucket_size"></s:key>
       <s:key name="constrain_to_origin_site">0</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="force_roll">0</s:key>
       <s:key name="frozen">0</s:key>
       <s:key name="index">_internal</s:key>
       <s:key name="origin_site">site2</s:key>
       <s:key name="peers">
         <s:dict>
           <s:key name="61666763-43E9-411B-9464-D80A5119EF0E">
             <s:dict>
               <s:key name="bucket_flags">0x2</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Searchable</s:key>
               <s:key name="status">StreamingTarget</s:key>
             </s:dict>
           </s:key>
           <s:key name="C878FADC-513D-4BDD-BA48-F25BB82FE565">
             <s:dict>
               <s:key name="bucket_flags">0x0</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Unsearchable</s:key>
               <s:key name="status">StreamingTarget</s:key>
             </s:dict>
           </s:key>
           <s:key name="E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C">
             <s:dict>
               <s:key name="bucket_flags">0x4</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Searchable</s:key>
               <s:key name="status">StreamingSource</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="primaries_by_site">
         <s:dict>
           <s:key name="site1">61666763-43E9-411B-9464-D80A5119EF0E</s:key>
           <s:key name="site2">E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C</s:key>
         </s:dict>
       </s:key>
       <s:key name="rep_count_by_site">
         <s:dict>
           <s:key name="site1">1</s:key>
           <s:key name="site2">2</s:key>
         </s:dict>
       </s:key>
       <s:key name="search_count_by_site">
         <s:dict>
           <s:key name="site1">1</s:key>
           <s:key name="site2">1</s:key>
         </s:dict>
       </s:key>
       <s:key name="service_after_time">0</s:key>
       <s:key name="standalone">0</s:key>
     </s:dict>
   </content>
 </entry>


cluster/master/buckets/{name}

https://<host>:<mPort>/services/cluster/master/buckets/{name}

Access bucket configuration information.


GET

List bucket configuration information.


Request parameters

The filter parameter of the Pagination and filtering parameters can be used with this method.


Returned values

Name Description
bucket_size Indicates the size, in bytes, of the bucket.
constrain_to_origin_site Flag indicating this particular bucket is a clustered pre-multisite bucket. Such buckets are replicated only within their origin site.
force_roll Flag indicating hot bucket needs to be force to roll by master. Usually when hot bucket does not have enough streaming targets to meet the policy.
frozen Indicates if the bucket is frozen.
index Name of the index to which the bucket belongs.
origin_site Where the bucket originated.
peers Lists information about buckets on peers to this master.
primaries_by_site Primary peer (GIUD).
rep_count_by_site Number of buckets.
search_count_by_site Number of searchable buckets.
service_after_time Bucket service is deferred until after this time.
standalone Indicates if the bucket was created on the peer before the peer entered into a cluster configuration with this master.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/buckets/internal~1~238C3311-F0A4-4A9B-97F0-53667CFFEEAB

XML Response

<title>clustermasterbuckets</title>
 <id>https://localhost:8089/services/cluster/master/buckets</id>
 <updated>2014-04-17T19:16:03+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/master/buckets/_new" rel="create"/>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>_internal~1~238C3311-F0A4-4A9B-97F0-53667CFFEEAB</title>
   <id>https://localhost:8089/services/cluster/master/buckets/_internal~1~238C3311-F0A4-4A9B-97F0-53667CFFEEAB</id>
   <updated>2014-04-17T19:16:03+00:00</updated>
   <link href="/services/cluster/master/buckets/_internal~1~238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/buckets/_internal~1~238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="list"/>
   <link href="/services/cluster/master/buckets/_internal~1~238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="bucket_size"></s:key>
       <s:key name="constrain_to_origin_site">0</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="eai:attributes">
         ... elided ...
       </s:key>
       <s:key name="force_roll">0</s:key>
       <s:key name="frozen">0</s:key>
       <s:key name="index">_internal</s:key>
       <s:key name="origin_site">site2</s:key>
       <s:key name="peers">
         <s:dict>
           <s:key name="238C3311-F0A4-4A9B-97F0-53667CFFEEAB">
             <s:dict>
               <s:key name="bucket_flags">0x4</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Searchable</s:key>
               <s:key name="status">StreamingSource</s:key>
             </s:dict>
           </s:key>
           <s:key name="29F9560E-A44A-425C-8753-1C6158B46C84">
             <s:dict>
               <s:key name="bucket_flags">0x2</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Searchable</s:key>
               <s:key name="status">StreamingTarget</s:key>
             </s:dict>
           </s:key>
           <s:key name="C878FADC-513D-4BDD-BA48-F25BB82FE565">
             <s:dict>
               <s:key name="bucket_flags">0x0</s:key>
               <s:key name="checksum"></s:key>
               <s:key name="checksum_state">StableCksum</s:key>
               <s:key name="search_state">Unsearchable</s:key>
               <s:key name="status">StreamingTarget</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="primaries_by_site">
         <s:dict>
           <s:key name="site1">29F9560E-A44A-425C-8753-1C6158B46C84</s:key>
           <s:key name="site2">238C3311-F0A4-4A9B-97F0-53667CFFEEAB</s:key>
         </s:dict>
       </s:key>
       <s:key name="rep_count_by_site">
         <s:dict>
           <s:key name="site1">1</s:key>
           <s:key name="site2">2</s:key>
         </s:dict>
       </s:key>
       <s:key name="search_count_by_site">
         <s:dict>
           <s:key name="site1">1</s:key>
           <s:key name="site2">1</s:key>
         </s:dict>
       </s:key>
       <s:key name="service_after_time">0</s:key>
       <s:key name="standalone">0</s:key>
     </s:dict>
   </content>
 </entry>

cluster/master/buckets/{bucket_id}/fix

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/fix

Add the specified bucket to the fix list.

For more information, see Bucket-fixing scenarios in Managing Indexers and Clusters of Indexers.

Authentication and Authorization
Requires the admin role or indexes_edit capability.


POST

Add this bucket to the fix list.


Request parameters

None

Returned values
None


Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/cluster/master/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/fix -X POST


XML Response

  <title>clustermasterbuckets</title>
  <id>https://localhost:8089/services/cluster/master/buckets</id>
  <updated>2015-11-04T12:23:57-08:00</updated>
  <generator build="8effae892620f7b651853d141b7b7a6b61b929c0" version="20151102"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/master/buckets/_new" rel="create"/>
  <link href="/services/cluster/master/buckets/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>


cluster/master/buckets/{bucket_id}/freeze

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/freeze

Set the bucket's state to frozen. The frozen state may not persist after a cluster master restart unless one of the peers has set the frozen state. A POST to this endpoint does not set the bucket's state to frozen on peers.

Note: Use this endpoint with caution. It is recommended to test the endpoint in a test cluster prior to use on an actual bucket.

For more information, see How the cluster handles frozen buckets in Managing Indexers and Clusters of Indexers.

Authentication and Authorization

Requires the admin role or indexes_edit capability.


POST

Set this bucket's state to frozen.

Request parameters
None

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/freeze -X POST


XML Response

  <title>clustermasterbuckets</title>
  <id>https://locahost:8089/services/cluster/master/buckets</id>
  <updated>2015-11-04T12:21:27-08:00</updated>
  <generator build="8effae892620f7b651853d141b7b7a6b61b929c0" version="20151102"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/master/buckets/_new" rel="create"/>
  <link href="/services/cluster/master/buckets/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>


cluster/master/buckets/{bucket_id}/remove_all

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/remove_all

Delete all copies of the specified bucket.

Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test cluster prior to use on an actual bucket.

Authentication and Authorization
Requires the admin role or indexes_edit capability.


POST

Delete all copies of the specified bucket.


Request parameters

None

Returned values

None. If an invalid bucket id is used, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': bucket not found</msg>
  </messages>
</response>

If the request is made on a hot bucket, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': cannot remove hot bucket from cluster</msg>
  </messages>
</response>

Example request and response

XML Request

curl -k -u admin:password https://localhost:8089/services/cluster/master/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/remove_all -X POST

XML Response

<title>clustermasterbuckets</title>
  <id>https://localhost:8089/services/cluster/master/buckets</id>
  <updated>2015-11-04T12:24:12-08:00</updated>
  <generator build="8effae892620f7b653d141b7b7a6b61b929c0" version="20151102"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/master/buckets/_new" rel="create"/>
  <link href="/services/cluster/master/buckets/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>


cluster/master/buckets/{bucket_id}/remove_from_peer

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/remove_from_peer

Deletes the copy of this bucket from specified peer.

If the request causes the cluster to lose its complete state, the cluster will engage in fixup activities. This may result in another copy of the same bucket appearing on this peer. If, however, the specified bucket is frozen, the cluster does not attempt any fixup activities.

Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test-cluster prior to use on an actual bucket.


Authentication and Authorization
Requires the admin role or indexes_edit capability.


POST

Delete this bucket from specified peer. Set bucket state to frozen

Request parameters

Name Type Description
peer (required) GUID Peer GUID


Returned values
None. If the peer parameter is missing from the request, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': The following required arguments are missing: peer.</msg>
  </messages>
</response>

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/remove_from_peer -X POST -d peer=222275BA-00DF-4CFE-9AEC-48A87B97EC71

XML Response

 <title>clustermasterbuckets</title>
  <id>https://localhost:8089/services/cluster/master/buckets</id>
  <updated>2015-11-04T12:23:18-08:00</updated>
  <generator build="8effae892620f7b651853d141b7b7a6b61b929c0" version="20151102"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/master/buckets/_new" rel="create"/>
  <link href="/services/cluster/master/buckets/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>


cluster/master/control/control/rebalance_primaries

https://<host>:<mPort>/services/cluster/master/control/control/rebalance_primaries

Rebalance primary bucket copies across peers. For more information, see Rebalance the indexer cluster primary buckets in Managing Indexers and Clusters of Indexers.


POST

Rebalance primary buckets across all peers of this master.


Request parameters

None

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/control/control/rebalance_primaries --request POST

XML Response

<title>clustermastercontrol</title>
 <id>https://localhost:8089/services/cluster/master/control</id>
 <updated>2013-08-21T13:08:52-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>

cluster/master/control/control/remove_peers

https://<host>:<mPort>/services/cluster/master/control/control/remove_peers

Remove one or more peers.

See also
cluster/master/peers


POST

Remove one or more peers.


Request parameters

Name Type Description
peers
Required
String One or more comma-separated peer GUIDs.


Returned values
None


Application usage

If peer status is not Down or GracefulShutdown, the interface returns the following error message:

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermastercontrol': Remove aborted, Reason: Peer=<hostname> with guid=<peerID> cannot be removed. Peer has status=Up. Only peers with status=Down (or) GracefulShutdown can be removed.</msg>
  </messages>
</response>


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/control/control/remove_peers --request POST  -d "peers=F2AA19BD-622F-4F8C-A8E0-1233"

XML Response

 <title>clustermastercontrol</title>
 <id>https://localhost:8089/services/cluster/master/control</id>
 <updated>2014-09-10T13:12:54-07:00</updated>
 <generator build="230688" version="6.2"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...

cluster/master/control/control/roll-hot-buckets

https://<host>:<mPort>/services/cluster/master/control/control/roll-hot-buckets

This endpoint forces a specified bucket in an indexer cluster to roll from hot to warm. Pass the bucket id (bid) to the master node. The master instructs the origin peer for that bucket to roll its copy. In turn, the origin peer tells all the replicating peers to roll their copies

You might discover a bucket that is stuck in fixup and needs to be rolled using logs, Splunk Web, or either of the following two endpoints.


Authorization and authentication
This endpoint requires the admin role for use.


POST

Force a bucket to roll from hot to warm.


Request parameters

Name Type Default Description
bucket_id String N/A Required. ID for bucket to roll.


Returned values
None.


Example request and response

XML Request

curl -k -u username:password https://localhost:8089/services/cluster/master/control/control/roll-hot-buckets -X POST -d "bucket_id=_audit~2~1A3889D7-954B-4CE6-B071-01B438DE9865"

XML Response

<title>clustermastercontrol</title>
  <id>https://localhost:8089/services/cluster/master/control</id>
  <updated>2015-10-30T07:34:56+08:00</updated>
  <generator build="0d98363e4338" version="6.4.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/master/control/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>

cluster/master/fixup

https://<host>:<mPort>/services/cluster/master/fixup

Access a list of buckets on a specific fixup priority level. Bucket fixups are processed in order of priority level. See Request parameters below for priority level details.

When you access a particular fixup level, buckets may appear in it even though they do not need fixup at this level. Initially, each bucket requiring fixup is added to all levels, even though it might only require processing in a subset of all levels. As the bucket is processed through a level, it is deleted from that level.


GET

List buckets on the specified fixup level.


Request parameters

Pagination and filtering parameters can be used with this method.

Name Datatype Description
level String Required. Fixup priority level. Use one of the following level values, listed in order of priority.
  • streaming : Hot buckets that need to be rolled or have their size committed.
  • data_safety : Buckets without at least two rawdata copies.
  • generation : Buckets without a primary copy.
  • replication_factor : Buckets without replication factor number of copies.
  • search_factor : Buckets without search factor number of copies.
  • checksum_sync : Level for syncing a bucket's delete files across all peers that have this bucket. Syncing is determined based on the checksum of all of the delete files.
index String Optional. Index name.


Returned values
For each bucket in the specified fixup level, the response includes the following details for the initial time when the bucket went into the fixup level and the latest time that the bucket was checked.

Name Description
id Bucket id.
reason Initial or latest reason for the bucket being on this fixup level.
timestamp Timestamp for initial bucket addition to fixup list or latest bucket check.


Example request and response

XML Request

curl -k -u admin:password https://localhost:8089/services/cluster/master/fixup?level=replication_factor

XML Response

<title>clustermasterfixup</title>
  <id>https://localhost:8089/services/cluster/master/fixup</id>
  <updated>2015-11-09T17:05:48-08:00</updated>
  <generator build="802b4ea159bb584c629dcdb8ba57c409b1d5b7ab" version="20151030"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/master/fixup/_acl" rel="_acl"/>
  <opensearch:totalResults>2</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>_audit~212~22220097-5E3F-4D26-B301-ECE3C4CD2222</title>
    <id>https://localhost:8089/services/cluster/master/fixup/_audit~212~22220097-5E3F-4D26-B301-ECE3C4CD2222</id>
    <updated>2015-11-09T17:05:48-08:00</updated>
    <link href="/services/cluster/master/fixup/_audit~212~22220097-5E3F-4D26-B301-ECE3C4CD2222" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/cluster/master/fixup/_audit~212~22220097-5E3F-4D26-B301-ECE3C4CD2222" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="index">_audit</s:key>
        <s:key name="initial">
          <s:dict>
            <s:key name="reason">add peer=22220097-5E3F-4D26-B301-ECE3C4CD2222 new bucket</s:key>
            <s:key name="timestamp">1447099323</s:key>
          </s:dict>
        </s:key>
        <s:key name="latest">
          <s:dict>
            <s:key name="reason">Missing enough suitable candidates to create replicated copy in order to meet replication policy. Missing={ site2:1 }</s:key>
            <s:key name="timestamp">1447117547</s:key>
          </s:dict>
        </s:key>
        <s:key name="level">replication_factor</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>_internal~12628~111163F8-61F4-4AB3-A1A7-2EDCB10C1111</title>
    <id>https://localhost:8089/services/cluster/master/fixup/_internal~12628~111163F8-61F4-4AB3-A1A7-2EDCB10C1111</id>
    <updated>2015-11-09T17:05:48-08:00</updated>
    <link href="/services/cluster/master/fixup/_internal~12628~111163F8-61F4-4AB3-A1A7-2EDCB10C1111" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/cluster/master/fixup/_internal~12628~111163F8-61F4-4AB3-A1A7-2EDCB10C1111" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="index">_internal</s:key>
        <s:key name="initial">
          <s:dict>
            <s:key name="reason">add peer=111163F8-61F4-4AB3-A1A7-2EDCB10C1111 new bucket</s:key>
            <s:key name="timestamp">1447099323</s:key>
          </s:dict>
        </s:key>
        <s:key name="latest">
          <s:dict>
            <s:key name="reason">Missing enough suitable candidates to create replicated copy in order to meet replication policy. Missing={ site1:1 }</s:key>
            <s:key name="timestamp">1447117547</s:key>
          </s:dict>
        </s:key>
        <s:key name="level">replication_factor</s:key>
      </s:dict>
    </content>
  </entry>


cluster/master/generation

https://<host>:<mPort>/services/cluster/master/generation

Access current generation cluster master information and create a cluster generation.


GET

List peer nodes participating in the current generation for this master.


Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Name Description
generation_id The ID for the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/generation

XML Response

<title>clustermastergeneration</title>
 <id>https://localhost:8089/services/cluster/master/generation</id>
 <updated>2012-09-05T10:39:54-07:00</updated>
 <generator build="136169" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>master</title>
   <id>https://localhost:8089/services/cluster/master/generation/master</id>
   <updated>2012-09-05T10:39:54-07:00</updated>
   <link href="/services/cluster/master/generation/master" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/generation/master" rel="list"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="generation_id">2</s:key>
       <s:key name="generation_peers">
         <s:dict>
           <s:key name="2AF11DD4-1424-4A14-A522-FB9D055E9516">
             <s:dict>
               <s:key name="host_port_pair">splunks-ombra.sv.splunk.com:8389</s:key>
               <s:key name="peer">splunks-ombra.sv.splunk.com</s:key>
             </s:dict>
           </s:key>
           <s:key name="50FCDB42-E167-458D-A6A9-E4587E8F16D9">
             <s:dict>
               <s:key name="host_port_pair">splunks-ombra.sv.splunk.com:8189</s:key>
               <s:key name="peer">splunks-ombra.sv.splunk.com</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="pending_generation_id">3</s:key>
       <s:key name="pending_last_attempt">0</s:key>
       <s:key name="pending_last_reason"></s:key>
     </s:dict>
   </content>
 </entry>


POST

Create a cluster generation.


Request parameters

Name Type Default Description
name
required
String The URI of the searchhead node of a cluster upon which to create a new generation.
generation_poll_interval Number How often, in seconds, the searchhead polls the master for generation information.

Defaults to 60 seconds.

label String Server name for the Splunk platform instance specified by the name attribute.
mgmt_port String The managment port of searchhead node in a cluster upon which you are creating a new generation.
register_search_address String The address on which a peer node is available as search head.

This is useful in the cases where a host machine has multiple interfaces and only one of them can be reached by another splunkd instance.


Returned values

Name Description
generation_id The ID for the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.

replication_factor_met Indicates if the replication factor was met for the cluster.
search_factor_met Indicates if the search factor was met for the cluster.
was_forced Indicates next generation was forcibly committed.

Example request and response
XML Request

curl -k -u admin:pass https://myserver:8089/services/cluster/master/generation -d name=foo

XML Response

<title>clustermastergeneration</title>
 <id>https://myserver:8089/services/cluster/master/generation</id>
 <updated>2013-10-31T13:58:51-07:00</updated>
 <generator build="184661" version="20131030"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/master/generation/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>master</title>
   <id>https://myserver:8089/services/cluster/master/generation/master</id>
   <updated>2013-10-31T13:58:51-07:00</updated>
   <link href="/services/cluster/master/generation/master" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/generation/master" rel="list"/>
   <link href="/services/cluster/master/generation/master" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="generation_id">5</s:key>
       <s:key name="generation_peers">
         <s:dict>
           <s:key name="11111111-1111-1111-1111-111111111111">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6431</s:key>
               <s:key name="peer">PEER1</s:key>
             </s:dict>
           </s:key>
           <s:key name="22222222-2222-2222-2222-222222222222">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6432</s:key>
               <s:key name="peer">PEER2</s:key>
             </s:dict>
           </s:key>
           <s:key name="33333333-3333-3333-3333-333333333333">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6433</s:key>
               <s:key name="peer">PEER3</s:key>
             </s:dict>
           </s:key>
           <s:key name="44444444-4444-4444-4444-444444444444">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6434</s:key>
               <s:key name="peer">PEER4</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="pending_generation_id">6</s:key>
       <s:key name="pending_last_attempt">0</s:key>
       <s:key name="pending_last_reason"></s:key>
       <s:key name="replication_factor_met">1</s:key>
       <s:key name="search_factor_met">1</s:key>
       <s:key name="was_forced">0</s:key>
     </s:dict>
   </content>
 </entry>

cluster/master/generation/{name}

https://<host>:<mPort>/services/cluster/master/generation/{name}

Access information about a peer node participating in the current generation for the specified search head GUID.


GET

List peer node information of the specified search head GUID.


Request parameters

None


Returned values

Name Description
generation_id The ID of the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/generation/master

XML Response

<title>clustermastergeneration</title>
 <id>https://localhost:8089/services/cluster/master/generation</id>
 <updated>2012-09-05T10:45:27-07:00</updated>
 <generator build="136169" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>master</title>
   <id>https://localhost:8089/services/cluster/master/generation/master</id>
   <updated>2012-09-05T10:45:27-07:00</updated>
   <link href="/services/cluster/master/generation/master" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/generation/master" rel="list"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       ... eai:attributes node elided ...
       <s:key name="generation_id">2</s:key>
       <s:key name="generation_peers">
         <s:dict>
           <s:key name="2AF11DD4-1424-4A14-A522-FB9D055E9516">
             <s:dict>
               <s:key name="host_port_pair">splunks-ombra.sv.splunk.com:8389</s:key>
               <s:key name="peer">splunks-ombra.sv.splunk.com</s:key>
             </s:dict>
           </s:key>
           <s:key name="50FCDB42-E167-458D-A6A9-E4587E8F16D9">
             <s:dict>
               <s:key name="host_port_pair">splunks-ombra.sv.splunk.com:8189</s:key>
               <s:key name="peer">splunks-ombra.sv.splunk.com</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="pending_generation_id">3</s:key>
       <s:key name="pending_last_attempt">0</s:key>
       <s:key name="pending_last_reason"></s:key>
     </s:dict>
   </content>
 </entry>


POST

Create a new generation for the specified search head GUID.


Request parameters

Name Type Description
generation_poll_interval Number How often, in seconds, the searchhead polls the master for generation information.

Defaults to 60 seconds.

label String Server name for the search head specified by {name}.
mgmt_port String The managment port of searchhead node in a cluster upon which you are creating a new generation.
register_search_address String The address on which a peer node is available as search head.

This is useful when a host machine has multiple interfaces and only one of them can be reached by another splunkd instance.


Returned values

Name Description
generation_id The ID for the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.

replication_factor_met Indicates if the replication factor was met for the cluster.
search_factor_met Indicates if the search factor was met for the cluster.
was_forced Indicates next generation was forcibly committed.


Example request and response

XML Request

curl -k -u admin:pass https://myserver:8089/services/cluster/master/generation/foo -X POST -d generation_poll_interval=62 -d label=PEER2

XML Response

 <title>clustermastergeneration</title>
 <id>https://myserver:8089/services/cluster/master/generation</id>
 <updated>2013-10-31T14:37:20-07:00</updated>
 <generator build="184661" version="20131030"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/master/generation/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>master</title>
   <id>https://myserver:8089/services/cluster/master/generation/master</id>
   <updated>2013-10-31T14:37:20-07:00</updated>
   <link href="/services/cluster/master/generation/master" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/generation/master" rel="list"/>
   <link href="/services/cluster/master/generation/master" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="generation_id">5</s:key>
       <s:key name="generation_peers">
         <s:dict>
           <s:key name="11111111-1111-1111-1111-111111111111">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6431</s:key>
               <s:key name="peer">PEER1</s:key>
             </s:dict>
           </s:key>
           <s:key name="22222222-2222-2222-2222-222222222222">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6432</s:key>
               <s:key name="peer">PEER2</s:key>
             </s:dict>
           </s:key>
           <s:key name="33333333-3333-3333-3333-333333333333">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6433</s:key>
               <s:key name="peer">PEER3</s:key>
             </s:dict>
           </s:key>
           <s:key name="44444444-4444-4444-4444-444444444444">
             <s:dict>
               <s:key name="host_port_pair">myserver.splunk.com:6434</s:key>
               <s:key name="peer">PEER4</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="pending_generation_id">6</s:key>
       <s:key name="pending_last_attempt">0</s:key>
       <s:key name="pending_last_reason"></s:key>
       <s:key name="replication_factor_met">1</s:key>
       <s:key name="search_factor_met">1</s:key>
       <s:key name="was_forced">0</s:key>
     </s:dict>
   </content>
 </entry>

cluster/master/indexes

https://<host>:<mPort>/services/cluster/master/indexes

Access cluster index information.


GET

List cluster indices.


Request parameters

None


Returned values

Attribute Description
buckets_with_excess_copies Number of distinct buckets that have one or more excess replication copies.
buckets_with_excess_searchable_copies Number of distinct buckets that have one or more excess searchable copies.
index_size Size of the index
is_searchable When every bucket in the index has a primary, the index is considered "searchable".
non_site_aware_buckets_in_site_aware_cluster Number of buckets created when the cluster was not in a multisite config. (Included only when the cluster is in multisite config.)
num_buckets Total number of distinct buckets.
replicated_copies_tracker Displays how many distinct buckets have X number of copies. One of the following options.
actual_copies_per_slot
Number of buckets with X copies.
expected_total_per_slot
Expected number of buckets with X copies.
searchable_copies_tracker Displays how many distinct buckets have X number of searchable copies. One of the following options.
actual_copies_per_slot
Number of buckets with X searchable copies.
expected_total_per_slot
Expected number of buckets with X searchable copies.
sort_order Used by UI.
total_excess_bucket_copies Total number of excess copies for all buckets.
total_excess_searchable_copies Total number of excess searchable copies for all buckets.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/indexes

XML Response

<title>clustermasterpeerindexes</title>
 <id>https://localhost:8089/services/cluster/master/indexes</id>
 <updated>2014-04-17T19:11:14+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>2</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>_audit</title>
   <id>https://localhost:8089/services/cluster/master/indexes/_audit</id>
   <updated>2014-04-17T19:11:14+00:00</updated>
   <link href="/services/cluster/master/indexes/_audit" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/indexes/_audit" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="buckets_with_excess_copies">0</s:key>
       <s:key name="buckets_with_excess_searchable_copies">0</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="index_size">284975</s:key>
       <s:key name="is_searchable">1</s:key>
       <s:key name="non_site_aware_buckets_in_site_aware_cluster">6</s:key>
       <s:key name="num_buckets">12</s:key>
       <s:key name="replicated_copies_tracker">
         <s:dict>
           <s:key name="0">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="1">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="2">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="searchable_copies_tracker">
         <s:dict>
           <s:key name="0">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="1">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="sort_order">4294967295</s:key>
       <s:key name="total_excess_bucket_copies">0</s:key>
       <s:key name="total_excess_searchable_copies">0</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>_internal</title>
   <id>https://localhost:8089/services/cluster/master/indexes/_internal</id>
   <updated>2014-04-17T19:11:14+00:00</updated>
   <link href="/services/cluster/master/indexes/_internal" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/indexes/_internal" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="buckets_with_excess_copies">0</s:key>
       <s:key name="buckets_with_excess_searchable_copies">0</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="index_size">1190869</s:key>
       <s:key name="is_searchable">1</s:key>
       <s:key name="non_site_aware_buckets_in_site_aware_cluster">6</s:key>
       <s:key name="num_buckets">12</s:key>
       <s:key name="replicated_copies_tracker">
         <s:dict>
           <s:key name="0">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="1">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="2">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="searchable_copies_tracker">
         <s:dict>
           <s:key name="0">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="1">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="sort_order">4294967295</s:key>
       <s:key name="total_excess_bucket_copies">0</s:key>
       <s:key name="total_excess_searchable_copies">0</s:key>
     </s:dict>
   </content>
 </entry>

cluster/master/indexes/{name}

https://<host>:<mPort>/services/cluster/master/indexes/{name}

Access specific cluster index information.


GET

List {name} index information.


Request parameters

None


Returned values

Attribute Description
buckets_with_excess_copies Number of distinct buckets that have one or more excess replication copies.
buckets_with_excess_searchable_copies Number of distinct buckets that have one or more excess searchable copies.
index_size Size of the index
is_searchable When every bucket in the index has a primary, the index is considered "searchable".
non_site_aware_buckets_in_site_aware_cluster Number of buckets created when the cluster was not in a multisite config. (Included only when the cluster is in multisite config.)
num_buckets Total number of distinct buckets. Displays how many distinct buckets have X number of copies. One of the following options.
actual_copies_per_slot
Number of buckets with X copies.
expected_total_per_slot
Expected number of buckets with X copies.
searchable_copies_tracker Displays how many distinct buckets have X number of searchable copies. One of the following options.
actual_copies_per_slot
Number of buckets with X searchable copies.
expected_total_per_slot
Expected number of buckets with X searchable copies.
sort_order Used by UI.
total_excess_bucket_copies Total number of excess copies for all buckets.
total_excess_searchable_copies Total number of excess searchable copies for all buckets.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/indexes/_audit

XML Response

<title>clustermasterpeerindexes</title>
 <id>https://localhost:8089/services/cluster/master/indexes</id>
 <updated>2014-04-17T19:11:14+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>2</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>_audit</title>
   <id>https://localhost:8089/services/cluster/master/indexes/_audit</id>
   <updated>2014-04-17T19:11:14+00:00</updated>
   <link href="/services/cluster/master/indexes/_audit" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/indexes/_audit" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="buckets_with_excess_copies">0</s:key>
       <s:key name="buckets_with_excess_searchable_copies">0</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="index_size">284975</s:key>
       <s:key name="is_searchable">1</s:key>
       <s:key name="non_site_aware_buckets_in_site_aware_cluster">6</s:key>
       <s:key name="num_buckets">12</s:key>
       <s:key name="replicated_copies_tracker">
         <s:dict>
           <s:key name="0">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="1">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="2">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="searchable_copies_tracker">
         <s:dict>
           <s:key name="0">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
           <s:key name="1">
             <s:dict>
               <s:key name="actual_copies_per_slot">12</s:key>
               <s:key name="expected_total_per_slot">12</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="sort_order">4294967295</s:key>
       <s:key name="total_excess_bucket_copies">0</s:key>
       <s:key name="total_excess_searchable_copies">0</s:key>
     </s:dict>
   </content>
 </entry>

cluster/master/info

https://<host>:<mPort>/services/cluster/master/info

Access information about cluster master node.


GET

List cluster master node details.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
active_bundle Provides information about the active bundle for this master.
bundle_creation_time_on_master The time, in epoch seconds, when the bundle was created on the master.
bundle_validation_errors_on_master A list of bundle validation errors.
bundle_validation_in_progress Indicates if bundle validation is in progress.
bundle_validation_on_master_succeeded Indicates whether the master succeeded validating bundles.
data_safety_buckets_to_fix Lists the buckets to fix for the completion of data safety.
gen_commit_buckets_to_fix The buckets to be fixed before the next generation can be committed.
indexing_ready_flag Indicates if the cluster is ready for indexing.
initialized_flag Indicates if the cluster is initialized.
label The name for the master. Displayed in the Splunk Web manager page.
latest_bundle The most recent information reflecting any changes made to the master-apps configuration bundle.

In steady state, this is equal to active_bundle. If it is not equal, then pushing the latest bundle to all peers is in process (or needs to be started).

maintenance_mode Indicates if the cluster is in maintenance mode.
reload_bundle_issued Indicates if the bundle issued is being reloaded.
rep_count_buckets_to_fix Number of buckets to fix on peers.
rolling_restart_flag Indicates whether the master is restarting the peers in a cluster.
search_count_buckets_to_fix Number of buckets to fix to satisfy the search count.
service_ready_flag Indicates whether the master is ready to begin servicing, based on whether it is initialized.
start_time Timestamp corresponding to the creation of the master.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/info

XML Response

<title>clustermasterinfo</title>
 <id>http://greentea.sv.splunk.com:8089/services/cluster/master/info</id>
 <updated>2013-07-23T10:36:35-07:00</updated>
 <generator build="172635" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>master</title>
   <id>http://greentea.sv.splunk.com:8089/services/cluster/master/info/master</id>
   <updated>2013-07-23T10:36:35-07:00</updated>
   <link href="/services/cluster/master/info/master" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/info/master" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="active_bundle">
         <s:dict>
           <s:key name="bundle_path">/home/eserv/schoi/apple_master/splunk/var/run/splunk/cluster/remote-bundle/66e383cafa8ff1f033e2341e35fc2e09-1374594357.bundle</s:key>
           <s:key name="checksum">a98f211c7bc6b141bd4fe5775c7cd193</s:key>
           <s:key name="timestamp">1374594357</s:key>
         </s:dict>
       </s:key>
       <s:key name="bundle_creation_time_on_master">1374594357</s:key>
       <s:key name="bundle_validation_errors_on_master">
         <s:list/>
       </s:key>
       <s:key name="bundle_validation_in_progress">0</s:key>
       <s:key name="bundle_validation_on_master_succeeded">1</s:key>
       <s:key name="data_safety_buckets_to_fix">
         <s:dict>
           <s:key name="_internal~1~05BB0AAC-61A5-491B-9153-3B02E6DA6130">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="_internal~1~76AFDA4D-DAA7-48A8-A738-DD669A0853CD">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
               .
               .
               .
             elided
               .
               .
               .
           <s:key name="i5~659~8CEAE4B4-BAB0-415E-9DA6-0438ECD8B3EF">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       ... eai:acl node elided ...
       <s:key name="gen_commit_buckets_to_fix">
         <s:dict>
           <s:key name="_internal~1~05BB0AAC-61A5-491B-9153-3B02E6DA6130">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="_internal~1~76AFDA4D-DAA7-48A8-A738-DD669A0853CD">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
               .
               .
               .
             elided
               .
               .
               .
           <s:key name="i5~659~8CEAE4B4-BAB0-415E-9DA6-0438ECD8B3EF">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="indexing_ready_flag">1</s:key>
       <s:key name="initialized_flag">1</s:key>
       <s:key name="label">master_nc</s:key>
       <s:key name="latest_bundle">
         <s:dict>
           <s:key name="bundle_path">/home/eserv/schoi/apple_master/splunk/var/run/splunk/cluster/remote-bundle/66e383cafa8ff1f033e2341e35fc2e09-1374594357.bundle</s:key>
           <s:key name="checksum">a98f211c7bc6b141bd4fe5775c7cd193</s:key>
           <s:key name="timestamp">1374594357</s:key>
         </s:dict>
       </s:key>
       <s:key name="maintenance_mode">0</s:key>
       <s:key name="reload_bundle_issued">0</s:key>
       <s:key name="rep_count_buckets_to_fix">
         <s:dict>
           <s:key name="_internal~1~05BB0AAC-61A5-491B-9153-3B02E6DA6130">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="_internal~1~76AFDA4D-DAA7-48A8-A738-DD669A0853CD">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
               .
               .
               .
             elided
               .
               .
               .
           <s:key name="i5~659~8CEAE4B4-BAB0-415E-9DA6-0438ECD8B3EF">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="rolling_restart_flag">0</s:key>
       <s:key name="search_count_buckets_to_fix">
         <s:dict>
           <s:key name="_internal~1~05BB0AAC-61A5-491B-9153-3B02E6DA6130">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="_internal~1~76AFDA4D-DAA7-48A8-A738-DD669A0853CD">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">resolved initial state</s:key>
                   <s:key name="timestamp">1374594631</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason"></s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
               .
               .
               .
             elided
               .
               .
               .
           <s:key name="i5~659~8CEAE4B4-BAB0-415E-9DA6-0438ECD8B3EF">
             <s:dict>
               <s:key name="initial">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
               <s:key name="latest">
                 <s:dict>
                   <s:key name="reason">streaming success</s:key>
                   <s:key name="timestamp">1374600995</s:key>
                 </s:dict>
               </s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="service_ready_flag">1</s:key>
       <s:key name="start_time">1374594571</s:key>
     </s:dict>
   </content>
 </entry>


cluster/master/peers

https://<host>:<mPort>/services/cluster/master/peers

Access cluster master peers.

See also
cluster/master/control/control/remove_peers


GET

List cluster master peers.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
active_bundle_id The ID of the configuration bundle currently being used by the master.
apply_bundle_status Bundle status enumeration.
base_generation_id The initial bundle generation ID recognized by this peer. Any searches from previous generations fail.

The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.

bucket_count Count of the number of buckets on this peer, across all indexes.
bucket_count_by_index Count of the number of buckets by index on this peer.
delayed_buckets_to_discard List of bucket IDs waiting to be discarded on this peer.
fixup_set The set of buckets that need repair once you take the peer offline.
heartbeat_started Flag indicating if this peer has started heartbeating.
host_port_pair The host and port advertised to peers for the data replication channel.

Can be either of the form IP:port or hostname:port.

is_searchable Flag indicating if this peer belongs to the current committed generation and is searchable.
label The name for the peer. Displayed on the manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer.
latest_bundle_id The ID of the configuration bundle this peer is using.
pending_job_count Used by the master to keep track of pending jobs requested by the master to this peer.
primary_count Number of buckets for which the peer is primary in its local site, or the number of buckets that return search results from same site as the peer.
primary_count_remote Number of buckets for which the peer is primary that are not in its local site.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
search_state_counter Lists the number of buckets on the peer for each search state for the bucket.


Possible values for search state include:

Searchable
Unsearchable
site To which site the peer belongs.
status Indicates the status of the peer.


Valid values are:

Up
Down
Pending
Detention
Restarting
DecommAwaitPeer
DecommFixingBuckets
Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status.

Possible values for bucket status:

Complete: complete (warm/cold) bucket
NonStreamingTarget: target of replication for already completed (warm/cold) bucket
PendingTruncate: bucket pending truncation
PendingDiscard: bucket pending discard
Standalone: bucket that is not replicated
StreamingError: copy of streaming bucket where some error was encountered
StreamingSource: streaming hot bucket on source side
StreamingTarget: streaming hot bucket copy on target side
Unset: uninitialized


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/peers


XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

 <title>clustermasterpeers</title>
 <id>https://localhost:8089/services/cluster/master/peers</id>
 <updated>2014-04-17T19:17:08+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/master/peers/_new" rel="create"/>
 <opensearch:totalResults>6</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>238C3311-F0A4-4A9B-97F0-53667CFFEEAB</title>
   <id>https://localhost:8089/services/cluster/master/peers/238C3311-F0A4-4A9B-97F0-53667CFFEEAB</id>
   <updated>2014-04-17T19:17:08+00:00</updated>
   <link href="/services/cluster/master/peers/238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/peers/238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="list"/>
   <link href="/services/cluster/master/peers/238C3311-F0A4-4A9B-97F0-53667CFFEEAB" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="active_bundle_id">4708B74780A1E5101449548B1E103616</s:key>
       <s:key name="apply_bundle_status">
         <s:dict>
           <s:key name="invalid_bundle">
             <s:dict>
               <s:key name="bundle_validation_errors">
                 <s:list/>
               </s:key>
               <s:key name="invalid_bundle_id"></s:key>
             </s:dict>
           </s:key>
           <s:key name="reload_error"></s:key>
           <s:key name="restart_required_for_apply_bundle">0</s:key>
         </s:dict>
       </s:key>
       <s:key name="base_generation_id">6</s:key>
       <s:key name="bucket_count">10</s:key>
       <s:key name="bucket_count_by_index">
         <s:dict>
           <s:key name="_audit">5</s:key>
           <s:key name="_internal">5</s:key>
         </s:dict>
       </s:key>
       <s:key name="delayed_buckets_to_discard">
         <s:list/>
       </s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="fixup_set">
         <s:list/>
       </s:key>
       <s:key name="heartbeat_started">1</s:key>
       <s:key name="host_port_pair">127.0.1.1:8096</s:key>
       <s:key name="is_searchable">1</s:key>
       <s:key name="label">s2p3</s:key>
       <s:key name="last_heartbeat">1397762228</s:key>
       <s:key name="latest_bundle_id">4708B74780A1E5101449548B1E103616</s:key>
       <s:key name="pending_job_count">0</s:key>
       <s:key name="primary_count">5</s:key>
       <s:key name="primary_count_remote">2</s:key>
       <s:key name="replication_count">0</s:key>
       <s:key name="replication_port">9905</s:key>
       <s:key name="replication_use_ssl">0</s:key>
       <s:key name="search_state_counter">
         <s:dict>
           <s:key name="Searchable">5</s:key>
           <s:key name="SearchablePendingMask">0</s:key>
           <s:key name="Unsearchable">5</s:key>
         </s:dict>
       </s:key>
       <s:key name="site">site2</s:key>
       <s:key name="status">Up</s:key>
       <s:key name="status_counter">
         <s:dict>
           <s:key name="Complete">6</s:key>
           <s:key name="NonStreamingTarget">0</s:key>
           <s:key name="StreamingSource">2</s:key>
           <s:key name="StreamingTarget">2</s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
     .
     .
     .
   elided
     .
     .
     .
 <entry>
   <title>E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C</title>
   <id>https://localhost:8089/services/cluster/master/peers/E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C</id>
   <updated>2014-04-17T19:17:08+00:00</updated>
   <link href="/services/cluster/master/peers/E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/peers/E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C" rel="list"/>
   <link href="/services/cluster/master/peers/E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="active_bundle_id">4708B74780A1E5101449548B1E103616</s:key>
       <s:key name="apply_bundle_status">
         <s:dict>
           <s:key name="invalid_bundle">
             <s:dict>
               <s:key name="bundle_validation_errors">
                 <s:list/>
               </s:key>
               <s:key name="invalid_bundle_id"></s:key>
             </s:dict>
           </s:key>
           <s:key name="reload_error"></s:key>
           <s:key name="restart_required_for_apply_bundle">0</s:key>
         </s:dict>
       </s:key>
       <s:key name="base_generation_id">4</s:key>
       <s:key name="bucket_count">13</s:key>
       <s:key name="bucket_count_by_index">
         <s:dict>
           <s:key name="_audit">6</s:key>
           <s:key name="_internal">7</s:key>
         </s:dict>
       </s:key>
       <s:key name="delayed_buckets_to_discard">
         <s:list/>
       </s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="fixup_set">
         <s:list/>
       </s:key>
       <s:key name="heartbeat_started">1</s:key>
       <s:key name="host_port_pair">127.0.1.1:8094</s:key>
       <s:key name="is_searchable">1</s:key>
       <s:key name="label">s2p1</s:key>
       <s:key name="last_heartbeat">1397762227</s:key>
       <s:key name="latest_bundle_id">4708B74780A1E5101449548B1E103616</s:key>
       <s:key name="pending_job_count">0</s:key>
       <s:key name="primary_count">7</s:key>
       <s:key name="primary_count_remote">2</s:key>
       <s:key name="replication_count">0</s:key>
       <s:key name="replication_port">9903</s:key>
       <s:key name="replication_use_ssl">0</s:key>
       <s:key name="search_state_counter">
         <s:dict>
           <s:key name="PendingSearchable">0</s:key>
           <s:key name="Searchable">10</s:key>
           <s:key name="SearchablePendingMask">0</s:key>
           <s:key name="Unsearchable">3</s:key>
         </s:dict>
       </s:key>
       <s:key name="site">site2</s:key>
       <s:key name="status">Up</s:key>
       <s:key name="status_counter">
         <s:dict>
           <s:key name="Complete">6</s:key>
           <s:key name="NonStreamingTarget">0</s:key>
           <s:key name="StreamingSource">2</s:key>
           <s:key name="StreamingTarget">5</s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
</feed>

cluster/master/peers/{name}

https://<host>:<mPort>/services/cluster/master/peers/{name}

Access specified peer.


GET

Get {name} peer information.


Request parameters

Name Type Description
list_buckets Boolean Indicates whether to list the buckets for the peers to this master.

Returned values

Name Description
active_bundle_id The ID of the configuration bundle currently being used by the master.
apply_bundle_status Bundle status enumeration.
base_generation_id The initial bundle generation ID recognized by this peer. Any searches from previous generations fail.

The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.

bucket_count Count of the number of buckets on this peer, across all indexes.
bucket_count_by_index Count of the number of buckets by index on this peer.
delayed_buckets_to_discard List of bucket IDs waiting to be discarded on this peer.
fixup_set The set of buckets that need repair once you take the peer offline.
heartbeat_started Flag indicating if this peer has started heartbeating.
host_port_pair The host and port advertised to peers for the data replication channel.

Can be either of the form IP:port or hostname:port.

is_searchable Flag indicating if this peer belongs to the current committed generation and is searchable.
label The name for the peer. Displayed on the Splunk Web manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer.
latest_bundle_id The ID of the configuration bundle this peer is using.
pending_job_count Used by the master to keep track of pending jobs requested by the master to this peer.
primary_count Number of buckets for which the peer is primary in its local site, or the number of buckets that return search results from same site as the peer.
primary_count_remote Number of buckets for which the peer is primary that are not in its local site.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
search_state_counter Lists the number of buckets on the peer for each search state for the bucket.

Possible values for search state include:

Searchable
Unsearchable
site To which site the peer belongs.
status Indicates the status of the peer.

Valid values are:

Up
Down
Pending
Detention
Restarting
DecommAwaitPeer
DecommFixingBuckets
Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status.

Possible values for bucket status:

Complete: complete (warm/cold) bucket
NonStreamingTarget: target of replication for already completed (warm/cold) bucket
PendingTruncate: bucket pending truncation
PendingDiscard: bucket pending discard
Standalone: bucket that is not replicated
StreamingError: copy of streaming bucket where some error was encountered
StreamingSource: streaming hot bucket on source side
StreamingTarget: streaming hot bucket copy on target side
Unset: uninitialized


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/peers/29F9560E-A44A-425C-8753-1C6158B46C84

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

 <title>clustermasterpeers</title>
 <id>https://localhost:8089/services/cluster/master/peers</id>
 <updated>2014-04-17T19:18:19+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/master/peers/_new" rel="create"/>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>29F9560E-A44A-425C-8753-1C6158B46C84</title>
   <id>https://localhost:8089/services/cluster/master/peers/29F9560E-A44A-425C-8753-1C6158B46C84</id>
   <updated>2014-04-17T19:18:19+00:00</updated>
   <link href="/services/cluster/master/peers/29F9560E-A44A-425C-8753-1C6158B46C84" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/peers/29F9560E-A44A-425C-8753-1C6158B46C84" rel="list"/>
   <link href="/services/cluster/master/peers/29F9560E-A44A-425C-8753-1C6158B46C84" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="active_bundle_id">4708B74780A1E5101449548B1E103616</s:key>
       <s:key name="apply_bundle_status">
         <s:dict>
           <s:key name="invalid_bundle">
             <s:dict>
               <s:key name="bundle_validation_errors">
                 <s:list/>
               </s:key>
               <s:key name="invalid_bundle_id"></s:key>
             </s:dict>
           </s:key>
           <s:key name="reload_error"></s:key>
           <s:key name="restart_required_for_apply_bundle">0</s:key>
         </s:dict>
       </s:key>
       <s:key name="base_generation_id">3</s:key>
       <s:key name="bucket_count">11</s:key>
       <s:key name="bucket_count_by_index">
         <s:dict>
           <s:key name="_audit">6</s:key>
           <s:key name="_internal">5</s:key>
         </s:dict>
       </s:key>
       <s:key name="delayed_buckets_to_discard">
         <s:list/>
       </s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="eai:attributes">
         ... elided ...
       </s:key>
       <s:key name="fixup_set">
         <s:list/>
       </s:key>
       <s:key name="heartbeat_started">1</s:key>
       <s:key name="host_port_pair">127.0.1.1:8092</s:key>
       <s:key name="is_searchable">1</s:key>
       <s:key name="label">s1p3</s:key>
       <s:key name="last_heartbeat">1397762298</s:key>
       <s:key name="latest_bundle_id">4708B74780A1E5101449548B1E103616</s:key>
       <s:key name="pending_job_count">0</s:key>
       <s:key name="primary_count">6</s:key>
       <s:key name="primary_count_remote">2</s:key>
       <s:key name="replication_count">0</s:key>
       <s:key name="replication_port">9902</s:key>
       <s:key name="replication_use_ssl">0</s:key>
       <s:key name="search_state_counter">
         <s:dict>
           <s:key name="PendingSearchable">0</s:key>
           <s:key name="Searchable">8</s:key>
           <s:key name="SearchablePendingMask">0</s:key>
           <s:key name="Unsearchable">3</s:key>
         </s:dict>
       </s:key>
       <s:key name="site">site1</s:key>
       <s:key name="status">Up</s:key>
       <s:key name="status_counter">
         <s:dict>
           <s:key name="Complete">6</s:key>
           <s:key name="NonStreamingTarget">0</s:key>
           <s:key name="StreamingSource">2</s:key>
           <s:key name="StreamingTarget">3</s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
</feed>


cluster/master/sites

https://<host>:<mPort>/services/cluster/master/sites

Access cluster site information.


GET

List available cluster sites.


Request parameters

None


Returned values

Name Description
peers Peers list of host:port and server name.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/sites


XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

 <title>clustermastersites</title>
 <id>https://localhost:8089/services/cluster/master/sites</id>
 <updated>2014-04-17T19:12:15+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>2</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>site1</title>
   <id>https://localhost:8089/services/cluster/master/sites/site1</id>
   <updated>2014-04-17T19:12:15+00:00</updated>
   <link href="/services/cluster/master/sites/site1" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/sites/site1" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="peers">
         <s:dict>
           <s:key name="29F9560E-A44A-425C-8753-1C6158B46C84">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8092</s:key>
               <s:key name="server_name">s1p3</s:key>
             </s:dict>
           </s:key>
           <s:key name="61666763-43E9-411B-9464-D80A5119EF0E">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8091</s:key>
               <s:key name="server_name">s1p2</s:key>
             </s:dict>
           </s:key>
           <s:key name="76C88808-2727-42B4-8C05-72DC44630FE4">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8090</s:key>
               <s:key name="server_name">s1p1</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>site2</title>
   <id>https://localhost:8089/services/cluster/master/sites/site2</id>
   <updated>2014-04-17T19:12:15+00:00</updated>
   <link href="/services/cluster/master/sites/site2" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/sites/site2" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="peers">
         <s:dict>
           <s:key name="238C3311-F0A4-4A9B-97F0-53667CFFEEAB">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8096</s:key>
               <s:key name="server_name">s2p3</s:key>
             </s:dict>
           </s:key>
           <s:key name="C878FADC-513D-4BDD-BA48-F25BB82FE565">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8095</s:key>
               <s:key name="server_name">s2p2</s:key>
             </s:dict>
           </s:key>
           <s:key name="E4B2C5E4-0961-4F3A-A5F7-C3A4BB6B518C">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8094</s:key>
               <s:key name="server_name">s2p1</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
</feed>

cluster/master/sites/{name}

https://<host>:<mPort>/services/cluster/master/sites/{name}

Access specific cluster site information.


GET

List the {name} cluster site information.


Request parameters

None

Returned values

Name Description
peers Site peer reference, for each peer. Possible values include the following.
host_port_pair
Peer port number.
server_name
Peer server name.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/master/sites/site1


XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

 <title>clustermastersites</title>
 <id>https://localhost:8089/services/cluster/master/sites</id>
 <updated>2014-04-17T19:13:07+00:00</updated>
 <generator build="204899" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>site1</title>
   <id>https://localhost:8089/services/cluster/master/sites/site1</id>
   <updated>2014-04-17T19:13:07+00:00</updated>
   <link href="/services/cluster/master/sites/site1" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/master/sites/site1" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="eai:attributes">
         ... elided ...
       </s:key>
       <s:key name="peers">
         <s:dict>
           <s:key name="29F9560E-A44A-425C-8753-1C6158B46C84">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8092</s:key>
               <s:key name="server_name">s1p3</s:key>
             </s:dict>
           </s:key>
           <s:key name="61666763-43E9-411B-9464-D80A5119EF0E">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8091</s:key>
               <s:key name="server_name">s1p2</s:key>
             </s:dict>
           </s:key>
           <s:key name="76C88808-2727-42B4-8C05-72DC44630FE4">
             <s:dict>
               <s:key name="host_port_pair">127.0.1.1:8090</s:key>
               <s:key name="server_name">s1p1</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
</feed>



cluster/searchhead/generation

https://<host>:<mPort>/services/cluster/searchhead/generation

Access peer information in a cluster searchhead.


GET

List peers available to a cluster searchhead.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
generation_id The current generation ID for this searchhead, which is part of a cluster configuration.

The search head uses this information to determine which buckets to search across.

generation_peers List of peer nodes for the current generation in the cluster configuration for this searchhead.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/searchhead/generation

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clustersearchheadgeneration</title>
 <id>https://localhost:8089/services/cluster/searchhead/generation</id>
 <updated>2012-09-05T11:13:45-07:00</updated>
 <generator build="136169" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>master</title>
   <id>https://localhost:8089/services/cluster/searchhead/generation/master</id>
   <updated>2012-09-05T11:13:45-07:00</updated>
   <link href="/services/cluster/searchhead/generation/master" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/searchhead/generation/master" rel="list"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="generation_id">2</s:key>
       <s:key name="generation_peers">
         <s:dict>
           <s:key name="2AF11DD4-1424-4A14-A522-FB9D055E9516">
             <s:dict>
               <s:key name="host_port_pair">splunks-ombra.sv.splunk.com:8389</s:key>
               <s:key name="peer">splunks-ombra.sv.splunk.com</s:key>
             </s:dict>
           </s:key>
           <s:key name="50FCDB42-E167-458D-A6A9-E4587E8F16D9">
             <s:dict>
               <s:key name="host_port_pair">splunks-ombra.sv.splunk.com:8189</s:key>
               <s:key name="peer">splunks-ombra.sv.splunk.com</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
</feed>


cluster/searchhead/generation/{name}

https://<host>:<mPort>/services/cluster/searchhead/generation/{name}

Access peer of the master URI.


GET

Get {name} searchhead generation ID and generation peers.


Request parameters

None

Returned values

Name Description
generation_id The current generation ID for this searchhead, which is part of a cluster configuration.

The search head uses this information to determine which buckets to search across.

generation_peers List of peer nodes for the current generation in the cluster configuration for this searchhead.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/searchhead/generation/https%3A%252F%252Fmyserver-mbp15.sv.splunk.com%3A8989

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clustersearchheadgeneration</title>
 <id>https://localhost:53791/services/cluster/searchhead/generation</id>
 <updated>2012-09-07T14:11:59-07:00</updated>
 <generator build="136859" version="20120906"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>https://ronnie.splunk.com:53112</title>
   <id>https://localhost:53791/services/cluster/searchhead/generation/https%3A%252F%252Fronnie.splunk.com%3A53112</id>
   <updated>2012-09-07T14:11:59-07:00</updated>
   <link href="/services/cluster/searchhead/generation/https%3A%252F%252Fronnie.splunk.com%3A53112" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/searchhead/generation/https%3A%252F%252Fronnie.splunk.com%3A53112" rel="list"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       ... eai:attributes node elided ...
       <s:key name="generation_id">3</s:key>
       <s:key name="generation_peers">
         <s:dict>
           <s:key name="33333333-3333-3333-3333-333333333333">
             <s:dict>
               <s:key name="host_port_pair">10.1.42.3:53309</s:key>
               <s:key name="peer">peer3</s:key>
             </s:dict>
           </s:key>
           <s:key name="44444444-4444-4444-4444-444444444444">
             <s:dict>
               <s:key name="host_port_pair">10.1.42.3:53411</s:key>
               <s:key name="peer">peer4</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
     </s:dict>
   </content>
 </entry>
</feed>

cluster/searchhead/searchheadconfig

https://<host>:<mPort>/services/cluster/searchhead/searchheadconfig

Access cluster searchhead node configuration.


GET

List this cluster search head node configuration.


Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
None


Example request and response

XML Request

curl -k -u   admin:pass https://localhost:8089/services/cluster/searchhead/searchheadconfig

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clustersearchheadconfig</title>
 <id>https://localhost:8089/services/cluster/searchhead/searchheadconfig</id>
 <updated>2013-10-31T14:04:45-07:00</updated>
 <generator build="184661" version="20131030"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/searchhead/searchheadconfig/_new" rel="create"/>
 <link href="/services/cluster/searchhead/searchheadconfig/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>https://localhost:4567</title>
   <id>https://myserver:7588/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567</id>
   <updated>2013-10-31T14:04:45-07:00</updated>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="list"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567/_reload" rel="_reload"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="edit"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="master_uri">https://localhost:4567</s:key>
       <s:key name="secret">********</s:key>
     </s:dict>
   </content>
 </entry>
</feed>


POST

Configure this server as a cluster searchhead node.


Request parameters

Name Type Description
name String Required. The URI of the master node in the cluster.
secret String Required. Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master.

Corresponds to pass4SymmKey setting in server.conf.

Returned values
None


Example request and response

XML Request

curl -k -u admin:pass https://myserver:8089/services/cluster/searchhead/searchheadconfig -d name=https://myserver:4567 -d secret=testsecret

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clustersearchheadconfig</title>
 <id>https://localhost:8089/services/cluster/searchhead/searchheadconfig</id>
 <updated>2013-10-31T14:04:45-07:00</updated>
 <generator build="184661" version="20131030"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/searchhead/searchheadconfig/_new" rel="create"/>
 <link href="/services/cluster/searchhead/searchheadconfig/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>https://localhost:4567</title>
   <id>https://myserver:8089/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567</id>
   <updated>2013-10-31T14:04:45-07:00</updated>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="list"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567/_reload" rel="_reload"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="edit"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="master_uri">https://localhost:4567</s:key>
       <s:key name="secret">********</s:key>
     </s:dict>
   </content>
 </entry>
</feed>


cluster/searchhead/searchheadconfig/{name}

https://<host>:<mPort>/services/cluster/searchhead/searchheadconfig/{name}

Manage node in a cluster.


DELETE

Remove node from cluster.


Request parameters

None

Returned values
None


Example request and response

XML Request

curl -k -u admin:changeme  --request DELETE https://myserver.splunk.com:8089/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Fmyserver%3A8211


XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clustersearchheadconfig</title>
 <id>https://myserver.splunk.com:8089/services/cluster/searchhead/searchheadconfig</id>
 <updated>2013-11-05T14:34:42-08:00</updated>
 <generator build="184986" version="20131101"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/searchhead/searchheadconfig/_new" rel="create"/>
 <link href="/services/cluster/searchhead/searchheadconfig/_reload" rel="_reload"/>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
</feed>



GET

List cluster search head node configuration.


Request parameters

None


Returned values
None


Example request and response

XML Request

curl -k -u admin:pass https://myserver.splunk.com:7588/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clustersearchheadconfig</title>
 <id>https://myserver.splunk.com:8089/services/cluster/searchhead/searchheadconfig</id>
 <updated>2013-11-05T14:43:00-08:00</updated>
 <generator build="184986" version="20131101"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/cluster/searchhead/searchheadconfig/_new" rel="create"/>
 <link href="/services/cluster/searchhead/searchheadconfig/_reload" rel="_reload"/>
 ... openserch nodes elided ...
 <s:messages/>
 <entry>
   <title>https://localhost:4567</title>
   <id>https://myserver.splunk.com:7588/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567</id>
   <updated>2013-11-05T14:43:00-08:00</updated>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="list"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567/_reload" rel="_reload"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="edit"/>
   <link href="/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         <s:dict>
           <s:key name="app"></s:key>
           <s:key name="can_list">1</s:key>
           <s:key name="can_write">1</s:key>
           <s:key name="modifiable">0</s:key>
           <s:key name="owner">system</s:key>
           <s:key name="perms">
             <s:dict>
               <s:key name="read">
                 <s:list>
                   <s:item>admin</s:item>
                   <s:item>splunk-system-role</s:item>
                 </s:list>
               </s:key>
               <s:key name="write">
                 <s:list>
                   <s:item>admin</s:item>
                   <s:item>splunk-system-role</s:item>
                 </s:list>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="removable">0</s:key>
           <s:key name="sharing">system</s:key>
         </s:dict>
       </s:key>
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list>
               <s:item>master_uri</s:item>
               <s:item>secret</s:item>
             </s:list>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="master_uri">https://localhost:4567</s:key>
       <s:key name="secret">********</s:key>
     </s:dict>
   </content>
 </entry>
</feed>



POST

Update cluster search head node configuration.


Request parameters

Name Type Description
master_uri String The URI of the master node in the cluster for which this searchhead is configured.
secret String Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master.

Corresponds to pass4SymmKey setting in server.conf.

Returned values
None


cluster/slave/buckets

https://<host>:<mPort>/services/cluster/slave/buckets

Access cluster peers bucket configuration.


GET

List cluster peers bucket configuration.


Request parameters

Name Type Description
generation_id String The generation ID for this peer. For each generation, the master server in a cluster configuration assigns generation IDs. A generation identifies which copies of a cluster's buckets are primary and therefore can participate in a search.

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
checksum Used internally to identify this bucket.
earliest_time Indicates the time of the earliest event in this bucket.
generation_id The generation ID for this peer.
generations A sparse list of generation id to bucket primacy for the given peer.
latest_time Indicates the time for the latest event in this bucket.
search_state Indicates if the bucket is searchable or unsearchable.
status Indicates the status of this bucket. One of the following values.
Complete
The copy of this bucket contains the full complement of information.
StreamingSource
The copy of this bucket is sending data to peer nodes for replication.
StreamingTarget
The copy of this bucket is receiving replicated data.
NonStreamingTarget
This copy of a warm bucket replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError
The copy of this bucket encountered errors while streaming data.
PendingTruncate
The master asked the peer to truncate this copy of the bucket to a certain size and is waiting for confirmation.
PendingDiscard
The master asked the peer to discard this copy of the bucket (for whatever reason, and is waiting for confirmation.
Standalone
A bucket in the cluster that is not replicated.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/cluster/slave/buckets


XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clusterslavebuckets</title>
 <id>https://localhost:8189/services/cluster/slave/buckets</id>
 <updated>2012-09-05T12:29:42-07:00</updated>
 <generator build="136169" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>_audit~0~2AF11DD4-1424-4A14-A522-FB9D055E9516</title>
   <id>https://localhost:8189/services/cluster/slave/buckets/_audit~0~2AF11DD4-1424-4A14-A522-FB9D055E9516</id>
   <updated>2012-09-05T12:29:42-07:00</updated>
   <link href="/services/cluster/slave/buckets/_audit~0~2AF11DD4-1424-4A14-A522-FB9D055E9516" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/slave/buckets/_audit~0~2AF11DD4-1424-4A14-A522-FB9D055E9516" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="checksum"></s:key>
       ... eai:acl node elided ...
       <s:key name="earliest_time">1346859162</s:key>
       <s:key name="generations">
         <s:dict>
           <s:key name="0">0x0</s:key>
         </s:dict>
       </s:key>
       <s:key name="latest_time">1346859257</s:key>
       <s:key name="search_state">Searchable</s:key>
       <s:key name="status">Complete</s:key>
     </s:dict>
   </content>
 </entry>
 . . . elided ...
</feed>



cluster/slave/buckets/{name}

https://<host>:<mPort>/services/cluster/slave/buckets/{name}

Manage peer buckets.


DELETE

Remove specified bucket from peer node.


Request parameters

Name Type Description
bucket_id String Required. The identifier for the bucket to remove.


Returned values
None


Example request and response

XML Request

curl -k -u admin:pass --request DELETE https://myserver:8089/services/cluster/slave/buckets/_internal~58~11111111-1111-1111-1111-111111111111 -d bucket_id="_internal~58~11111111-1111-1111-1111-111111111111"


XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

     xmlns:s="http://dev.splunk.com/ns/rest"
     xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
 <title>clusterslavebuckets</title>
 <id>https://myserver:8089/services/cluster/slave/buckets</id>
 <updated>2013-10-31T14:48:18-07:00</updated>
 <generator build="184661" version="20131030"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
</feed>


GET

List peer specified bucket information.


Request parameters

Name Type Description
generation_id String The generation ID for this peer. For each generation, the master server in a cluster configuration assigns generation IDs. A generation identifies which copies of a cluster's buckets are primary and therefore can participate in a search.


Returned values

Name Description
checksum Used internally to identify this bucket.
earliest_time Indicates the time of the earliest event in this bucket.
generation_id The generation ID for this peer.
generations A sparse list of generation id to bucket primacy for the given peer.
latest_time Indicates the time for the latest event in this bucket.
search_state Indicates if the bucket is Searchable or Unsearchable.
status Indicates the status of this bucket. One of the following values.
Complete
The copy of this bucket contains the full complement of information.
StreamingSource
The copy of this bucket is sending data to peer nodes for replication.
StreamingTarget
The copy of this bucket is receiving replicated data.
NonStreamingTarget
This copy of a warm bucket replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError
The copy of this bucket encountered errors while streaming data.
PendingTruncate
The master asked the peer to truncate this copy of the bucket to a certain size and is waiting for confirmation.
PendingDiscard
The master asked the peer to discard this copy of the bucket (for whatever reason, and is waiting for confirmation.
Standalone
A bucket in the cluster that is not replicated.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/cluster/slave/buckets/_audit~0~B8B5E5C6-DB26-4952-AFB1-C5EFEFFFEA31

XML Response

.
.
.
 <title>clusterslavebuckets</title>
 <id>https://localhost:8189/services/cluster/slave/buckets</id>
 <updated>2012-09-05T12:40:43-07:00</updated>
 <generator build="136169" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>_internal~1~50FCDB42-E167-458D-A6A9-E4587E8F16D9</title>
   <id>https://localhost:8189/services/cluster/slave/buckets/_internal~1~50FCDB42-E167-458D-A6A9-E4587E8F16D9</id>
   <updated>2012-09-05T12:40:43-07:00</updated>
   <link href="/services/cluster/slave/buckets/_internal~1~50FCDB42-E167-458D-A6A9-E4587E8F16D9" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/slave/buckets/_internal~1~50FCDB42-E167-458D-A6A9-E4587E8F16D9" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="checksum"></s:key>
       ... eai:acl node elided ...
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list/>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="earliest_time">0</s:key>
       <s:key name="generations">
         <s:dict>
           <s:key name="0">0xffffffffffffffff</s:key>
         </s:dict>
       </s:key>
       <s:key name="latest_time">0</s:key>
       <s:key name="search_state">Searchable</s:key>
       <s:key name="status">StreamingSource</s:key>
     </s:dict>
   </content>
 </entry>


cluster/slave/control/control/re-add-peer

https://<host>:<mPort>/services/cluster/slave/control/control/re-add-peer

Set the peer to re-add itself to the master. This syncs the peer's state, including its in-memory bucket state, to the master. By default, this resets the peer's primary bucket copies and the master reassigns them across the cluster. To keep the peer's existing primary bucket copies, use the optional clearMasks=false parameter.

This endpoint can be useful when the master and the peer have a state mismatch, for example when bucket information is not in sync between them.


POST

Re-add the cluster indexer to the cluster master.


Request parameters

Name Type Default Description
clearMasks Boolean. Use true or false. true Optional. Indicates whether the master should reassign all primary bucket copies across all peers. The default true value prompts the master to reassign all primary bucket copies across all peers. Use false to re-add the peer but keep the existing primary bucket copies.


Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/cluster/slave/control/control/re-add-peer -d clearMasks=false -X POST

XML Response

  <title>clusterslavecontrol</title>
  <id>https://localhost:8089/services/cluster/slave/control</id>
  <updated>2015-11-06T18:08:54-08:00</updated>
  <generator build="802b4ea159bb584c629dcdb8ba57c409b1d5b7ab" version="20151030"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/slave/control/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>


cluster/slave/control/control/set_detention_override

https://<host>:<mPort>/services/cluster/slave/control/control/set_detention_override 

Put the peer node in manual detention. In manual detention, the peer does not serve as a replication target. Detention helps slow the growth of disk usage on the peer.

You can use this endpoint to set a peer to manual detention mode or to reverse this setting.

Note: Starting with version 6.5, manual detention persists through restarts.


POST

Adjust cluster peer detention mode.


Request parameters

Name Type Description
value Boolean Indicates whether peer is set to detention mode.


Returned values
None


Application usage
If an invalid argument or value is passed as the request parameter, a detailed error message is sent in response.

Invalid value error example


$ curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d value=BADVALUE -X POST

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clusterslavecontrol': key=value with val=BADVALUE is not a valid boolean value</msg>
  </messages>
</response>

Invalid argument error example

$ curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d badArgument=true -X POST

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clusterslavecontrol': Argument "badArgument" is not supported by this handler.</msg>
  </messages>
</response>


Example request and response

XML Request

curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d value=false -X POST

XML Response

.
.
.
  <title>clusterslavecontrol</title>
  <id>https://SLAVE:MGMT_PORT/services/cluster/slave/control</id>
  <updated>2015-08-11T16:24:32-07:00</updated>
  <generator build="8826868e4a29e7db785ebbafaac596e32f570382" version="20150805"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/cluster/slave/control/_acl" rel="_acl"/>
  <opensearch:totalResults>0</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>

cluster/slave/info

https://<host>:<mPort>/services/cluster/slave/info

Access cluster peer node information.


GET

List peer information.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
active_bundle Current bundle being used by this peer.
base_generation_id The initial bundle generation ID recognized by this peer. Any searches from previous generations fail.

The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.

invalid_bundle_ids List of bundle ids with validation errors in the peer.
is_registered Indicates if this peer is registered with the master in the cluster.
last_heartbeat_attempt Timestamp for the last attempt to contact the master.
latest_bundle Lists information about the most recent bundle downloaded from the master.
restart_state Indicates whether the peer needs to be restarted to enable its cluster configuration.
status Indicates the status of the peer. One of the following values.
  • Up
  • Down
  • Pending
  • Detention
  • Restarting
  • DecommAwaitingPeer
  • DecommFixingBuckets
  • Decommissioned


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/cluster/slave/info

XML Response

.
.
.
 <title>clusterslaveinfo</title>
 <id>https://localhost:8189/services/cluster/slave/info</id>
 <updated>2012-09-05T12:45:59-07:00</updated>
 <generator build="136169" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>slave</title>
   <id>https://localhost:8189/services/cluster/slave/info/slave</id>
   <updated>2012-09-05T12:45:59-07:00</updated>
   <link href="/services/cluster/slave/info/slave" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/cluster/slave/info/slave" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="active_bundle">
         <s:dict>
           <s:key name="bundle_path">/Applications/splunk-peer/var/run/splunk/cluster/remote-bundle/0f6078895127ab1f715ee78a6e1ff8a1-1346858928.bundle</s:key>
           <s:key name="checksum">36a883f4d47af66f78531ef474349b59</s:key>
           <s:key name="timestamp">1346858928</s:key>
         </s:dict>
       </s:key>
       <s:key name="base_generation_id">2</s:key>
       ... eai:acl node elided ...
       <s:key name="invalid_bundle_ids">
         <s:list/>
       </s:key>
       <s:key name="is_registered">1</s:key>
       <s:key name="last_heartbeat_attempt">1346874358</s:key>
       <s:key name="latest_bundle">
         <s:dict>
           <s:key name="bundle_path">/Applications/splunk-peer/var/run/splunk/cluster/remote-bundle/0f6078895127ab1f715ee78a6e1ff8a1-1346858928.bundle</s:key>
           <s:key name="checksum">36a883f4d47af66f78531ef474349b59</s:key>
           <s:key name="timestamp">1346858928</s:key>
         </s:dict>
       </s:key>
       <s:key name="restart_state">NoRestart</s:key>
       <s:key name="status">Up</s:key>
     </s:dict>
   </content>
 </entry>


replication/configuration/health

https://<host>:<mPort>/services/replication/configuration/health

Access configuration replication health statistics for a search head cluster.

GET

Access the configuration replication health statistics for a search head cluster.

Request parameters

Name Type Description
bookmark Boolean Use this parameter with a GET request on the captain. Set to 1 to list the most recent changesets that members pulled from the captain. A timestamp is also returned for each changeset.
check_share_baseline Boolean Set to 1 to check for a shared baseline among members. This parameter can be used with a request on any member, including the captain.
unpublished Boolean Set to 1 to check for unpublished changes on members. Use this parameter with a request on a member to check if the member has any changes that have not been pushed to the captain.


Returned values

Values returned depend on the request parameters used.

bookmark

Name Description
[server_name] For each [server_name] member, a changeset and timestamp are shown, indicating when the [server_name] member last pulled this set of configuration changes from the captain.

Example request and response

curl -k -u admin:pass https://localhost:8089/services/replication/configuration/health?bookmark=1

...
  <entry>
    <title>bookmark</title>
    <id>https://localhost:11089/services/replication/configuration/health/bookmark</id>
    <updated>2016-08-08T17:08:25-07:00</updated>
    <link href="/services/replication/configuration/health/bookmark" rel="alternate"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="https://localhost:11089">CaptainDummyOpId: Mon Aug  8 16:08:55 2016</s:key>
        <s:key name="https://localhost:8089">2d9e86111eb4a377c60563f93ea5274de8b9c438: Mon Aug  8 17:08:22 2016</s:key>
        <s:key name="https://localhost:9089">2d9e86111eb4a377c60563f93ea5274de8b9c438: Mon Aug  8 17:08:22 2016</s:key>
      </s:dict>
    </content>
  </entry>



check_share_baseline

Application usage
This parameter compares the baseline between the current instance, on which the GET request is made, with the baseline of other members. From each of the other members, the system retrieves the oldest changeset that is not more than 23 hours old and therefore safe from purging. The system then tries to find that changeset in the current instance's local changeset repository. If the changeset is found in the local repository, then the current instance and the member share a baseline.

Establishing a shared baseline between a captain and members is a prerequisite for successful configuration replication.

Name Description
check_share_baseline One of the following values is returned for each of the other members.

Yes: The current instance shares a baseline with this node.

No: The current instance node does not share a baseline with this node.

Connection error: The current instance cannot contact this node. A warning is logged with additional details.

server_name Name for the member whose baseline is being compared to the current instance.

Example request and response

curl -k -u admin:pass https://localhost:11089/services/replication/configuration/health?check_share_baseline=1

...
  <title>health</title>
  <id>https://localhost:11089/services/replication/configuration/health</id>
  <updated>2016-08-09T15:51:06-07:00</updated>
  <generator build="99005df760a86096252bb6b287ad7a6f3149a218" version="20160805"/>
  <author>
    <name>Splunk</name>
  </author>
  <entry>
    <title>https://localhost:8089</title>
    <id>https://localhost:11089/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A8089</id>
    <updated>2016-08-09T15:51:06-07:00</updated>
    <link href="/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A8089" rel="alternate"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="check_share_baseline">Yes</s:key>
        <s:key name="server_name">yxu-mbp15-node2</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>https://localhost:9089</title>
    <id>https://localhost:11089/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A9089</id>
    <updated>2016-08-09T15:51:06-07:00</updated>
    <link href="/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A9089" rel="alternate"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="check_share_baseline">Yes</s:key>
        <s:key name="server_name"> localhost-node3</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>https://localhost:11089</title>
    <id>https://localhost:11089/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A11089</id>
    <updated>2016-08-09T15:51:06-07:00</updated>
    <link href="/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A11089" rel="alternate"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="check_share_baseline">Yes</s:key>
        <s:key name="server_name"> localhost-node1</s:key>
      </s:dict>
    </content>
  </entry>
...


unpublished

A Number of unpublished changes key is returned with one of the following values.

Name Description
0 All changes on this cluster member have been pushed to the captain. There are no unpublished changes on this member.
0 (This instance is the captain) This message is returned when requesting unpublished status on the captain. The captain is always in sync with itself, so there are no unpublished changes.
[Number greater than 0] The number unpublished local changes on this member. Changes are held until the next replication occurs. The node is still healthy in this case.
No captain is available The search head cluster does not currently have a captain.
Missing common baseline with the captain This member might be out of sync with the captain if this message persists after several replication periods.

This message can also appear during a transition period, for example, when a captain is switched or a member is manually resynced. On a healthy search head cluster, the unpublished value should return to a numeric value after one replication period.


Example request and response

curl -k -u admin:pass https://localhost:11089/services/replication/configuration/health?unpublished=1

<title>health</title>
  <id>https://localhost:8089/services/replication/configuration/health</id>
  <updated>2016-08-09T13:14:16-07:00</updated>
  <generator build="99005df760a86096252bb6b287ad7a6f3149a218" version="20160805"/>
  <author>
    <name>Splunk</name>
  </author>
  <entry>
    <title>unpublished</title>
    <id>https://localhost:8089/services/replication/configuration/health/unpublished</id>
    <updated>2016-08-09T13:14:16-07:00</updated>
    <link href="/services/replication/configuration/health/unpublished" rel="alternate"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="Number of unpublished changes">0</s:key>
      </s:dict>
    </content>
  </entry>


shcluster/captain/artifacts

https://<host>:<mPort>/services/shcluster/captain/artifacts

Provides list of artifacts and replicas currently managed by the captain across a searchhead cluster.

This endpoint can only be accessed on the captain. The response lists all of the artifacts that are currently managed by the captain across the searchhead cluster, present on the various members.

An artifact in search head clustering is a managed search directory. Currently, only scheduled search results directories are managed and replicated according to replication policy.

Note: Ad hoc searches are not considered artifacts and are not listed.


GET

Lists searchhead cluster artifacts and replicas.


Request parameters

Name Type Description
remote_sids Bool Required. Set this to true to return the searches that the captain is seeing. Will include adhoc searches on remote members.


Returned values

Name Description
artifact_size Artifact size, in bytes.
origin_guid Guid of the origin peer where this artifact was created/search was run.
peers Lists information about replicas of this artifact on members of this searchhead cluster.
service_after_time Artifact service/fixup is deferred until after this time.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/captain/artifacts

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustercaptainartifacts</title>
  <id>https://localhost:8089/services/shcluster/captain/artifacts</id>
  <updated>2014-10-15T08:44:41-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/shcluster/captain/artifacts/_new" rel="create"/>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:44:41-07:00</updated>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="artifact_size">282624</s:key>
        ... eai:acl node elided ...
        <s:key name="origin_guid">88888888-8888-8888-8888-888888888888</s:key>
        <s:key name="peers">
          <s:dict>
            <s:key name="88888888-8888-8888-8888-888888888888">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/searchhead/var/run/splunk/dispatch/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
            <s:key name="99999999-9999-9999-9999-999999999999">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/dash/var/run/splunk/dispatch/rsa_scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="service_after_time">0</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:44:41-07:00</updated>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="artifact_size">282624</s:key>
        ... eai:acl node elided ...
        <s:key name="origin_guid">88888888-8888-8888-8888-888888888888</s:key>
        <s:key name="peers">
          <s:dict>
            <s:key name="88888888-8888-8888-8888-888888888888">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/searchhead/var/run/splunk/dispatch/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
            <s:key name="99999999-9999-9999-9999-999999999999">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/dash/var/run/splunk/dispatch/rsa_scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="service_after_time">0</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387300_288_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387300_288_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:44:41-07:00</updated>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387300_288_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387300_288_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387300_288_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="artifact_size">253952</s:key>
        ... eai:acl node elided ...
        <s:key name="origin_guid">88888888-8888-8888-8888-888888888888</s:key>
        <s:key name="peers">
          <s:dict>
            <s:key name="88888888-8888-8888-8888-888888888888">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/searchhead/var/run/splunk/dispatch/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387300_288_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
            <s:key name="99999999-9999-9999-9999-999999999999">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/dash/var/run/splunk/dispatch/rsa_scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387300_288_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="service_after_time">0</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387600_289_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387600_289_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:44:41-07:00</updated>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387600_289_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387600_289_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/captain/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387600_289_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="artifact_size">253952</s:key>
        ... eai:acl node elided ...
        <s:key name="origin_guid">88888888-8888-8888-8888-888888888888</s:key>
        <s:key name="peers">
          <s:dict>
            <s:key name="88888888-8888-8888-8888-888888888888">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/searchhead/var/run/splunk/dispatch/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387600_289_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
            <s:key name="99999999-9999-9999-9999-999999999999">
              <s:dict>
                <s:key name="directory_path">/home/svasan/splunk/dash/var/run/splunk/dispatch/rsa_scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387600_289_88888888-8888-8888-8888-888888888888</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="service_after_time">0</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

shcluster/captain/artifacts/{name}

https://<host>:<mPort>/services/shcluster/captain/artifacts/{name}

Get artifact information for a specific artifact.


GET

Get artifact information, size, replicas and earliest service time.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name ! Description
artifact_size Artifact size, in bytes.
origin_guid Guid of the origin peer where this artifact was created.
peers Lists information about artifacts on members of this captain.
service_after_time Artifact service is deferred until after this time.


Example request and response

XML Request

curl -k -u admin:pass https://locahost:8089/services/shcluster/captain/artifacts/scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111

XML Response


  <title>shclustercaptainartifacts</title>
  <id>https://localhost:8089/services/shcluster/captain/artifacts</id>
  <updated>2016-07-22T13:39:03-07:00</updated>
  <generator build="d6d01722fce508a9e2f032d36d8d6a445b7d6292" version="20160721"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/shcluster/captain/artifacts/_new" rel="create"/>
  <link href="/services/shcluster/captain/artifacts/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111</title>
    <id>https://localhost:8089/services/shcluster/captain/artifacts/scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111</id>
    <updated>2016-07-22T13:39:03-07:00</updated>
    <link href="/services/shcluster/captain/artifacts/scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/artifacts/scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111" rel="list"/>
    <link href="/services/shcluster/captain/artifacts/scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="artifact_size">77824</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:acl.app">simplexml</s:key>
        <s:key name="eai:attributes">
          <s:dict>
            <s:key name="optionalFields">
              <s:list/>
            </s:key>
            <s:key name="requiredFields">
              <s:list/>
            </s:key>
            <s:key name="wildcardFields">
              <s:list/>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="label">timechart_scheduled</s:key>
        <s:key name="origin_guid">11111111-1111-1111-1111-111111111111</s:key>
        <s:key name="peers">
          <s:dict>
            <s:key name="11111111-1111-1111-1111-111111111111">
              <s:dict>
                <s:key name="directory_path">/home/user/home_1/var/run/splunk/dispatch/scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
            <s:key name="33333333-3333-3333-3333-333333333333">
              <s:dict>
                <s:key name="directory_path">/home/user/home_3/var/run/splunk/dispatch/rsa_scheduler__nobody__simplexml__RMD5dc07359042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111</s:key>
                <s:key name="status">Complete</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="perms">read : [ *, splunk-system-user ], write : [ admin, power, splunk-system-user ]</s:key>
        <s:key name="service_after_time">0</s:key>
        <s:key name="user">splunk-system-user</s:key>
      </s:dict>
    </content>
  </entry>
</feed>



shcluster/captain/info

https://<host>:<mPort>/services/shcluster/captain/info

Access information about searchhead cluster captain node.


GET

List searchhead cluster captain node details.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
elected_captain Time when the current captain was elected
id Id of this SH cluster. This is used as the unique identifier for the Search Head Cluster in bundle replication and acceleration summary management.
initialized_flag Indicates if the searchhead cluster is initialized.
label The name for the captain. Displayed on the Splunk Web manager page.
maintenance_mode Indicates if the cluster is in maintenance mode.
min_peers_joined_flag Flag to indicate if more then replication_factor peers have joined the cluster.
peer_scheme_host_port URI of the current captain.
rolling_restart_flag Indicates whether the captain is restarting the members in a searchhead cluster.
service_ready_flag Indicates whether the captain is ready to begin servicing, based on whether it is initialized.
start_time Timestamp corresponding to the creation of the captain.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/captain/info

XML Response


<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustercaptaininfo</title>
  <id>https://localhost:8089/services/shcluster/captain/info</id>
  <updated>2014-10-15T08:45:25-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>captain</title>
    <id>https://localhost:8089/services/shcluster/captain/info/captain</id>
    <updated>2014-10-15T08:45:25-07:00</updated>
    <link href="/services/shcluster/captain/info/captain" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/info/captain" rel="list"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        <s:key name="elected_captain">1413307273</s:key>
        <s:key name="id">BB3116C0-73B9-459A-B473-254A18A69776</s:key>
        <s:key name="initialized_flag">1</s:key>
        <s:key name="label">searchhead</s:key>
        <s:key name="maintenance_mode">0</s:key>
        <s:key name="min_peers_joined_flag">1</s:key>
        <s:key name="peer_scheme_host_port">https://localhost:55569</s:key>
        <s:key name="rolling_restart_flag">0</s:key>
        <s:key name="service_ready_flag">1</s:key>
        <s:key name="start_time">1413307203</s:key>
      </s:dict>
    </content>
  </entry>
</feed>


shcluster/captain/jobs

https://<host>:<mPort>/services/shcluster/captain/jobs

List running and recently finished jobs for all cluster members.


GET

List running and recently finished jobs for this cluster.


Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
For each job:

Name Description
ATTEMPT_[n] dispatch_time - The UTC time of dispatch for the job
errormsg - If the job failed, capturing the reason for failure
peer - GUID of the member that the job was sent to
sid - the search id of this attempt
success - a boolean for success/failure of the job
job_state Job State can be SCHEDULED/DISPATCHED/COMPLETED. A SCHEDULED job has been received by the captain from the scheduler to schedule. A DISPATCHED job has started to run on a remote member. A COMPLETED job has finished running on the remote member.
saved_search The name of the saved-search from the associated savedsearches.conf file.
savedsearchtype The scheduler manages three kinds of scheduled jobs, regular savedsearch for both realtime and historical, autosummary report acceleration build searches, and tsidx tsidx build searches.
search_app The application in which the savedsearch was created.
search_owner The owner of the saved search.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/captain/jobs

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustercaptainjobs</title>
  <id>https://localhost:8089/services/shcluster/captain/jobs</id>
  <updated>2014-10-15T08:47:50-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/shcluster/captain/jobs/_new" rel="create"/>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>savedsearch_Alert - syslog errors last hour_1087026166</title>
    <id>https://localhost:8089/services/shcluster/captain/jobs/savedsearch_Alert%20-%20syslog%20errors%20last%20hour_1087026166</id>
    <updated>2014-10-15T08:47:50-07:00</updated>
    <link href="/services/shcluster/captain/jobs/savedsearch_Alert%20-%20syslog%20errors%20last%20hour_1087026166" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/jobs/savedsearch_Alert%20-%20syslog%20errors%20last%20hour_1087026166" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="ATTEMPT_1">
          <s:dict>
            <s:key name="dispatch_time">1413363600</s:key>
            <s:key name="errormsg">error response peer=https://wimpy.splunk.com:55560 rc=404 reason='<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Application does not exist: SA-nix</msg>
  </messages>
</response>
'</s:key>
            <s:key name="peer">99999999-9999-9999-9999-999999999999</s:key>
            <s:key name="sid">NO_SID_RECEIVED_YET</s:key>
            <s:key name="success">0</s:key>
          </s:dict>
        </s:key>
        <s:key name="ATTEMPT_2">
          <s:dict>
            <s:key name="dispatch_time">1413363600</s:key>
            <s:key name="peer">88888888-8888-8888-8888-888888888888</s:key>
            <s:key name="sid">scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413363600_203_88888888-8888-8888-8888-888888888888</s:key>
            <s:key name="success">1</s:key>
          </s:dict>
        </s:key>
        ... eai:acl node elided ...
        <s:key name="job_state">COMPLETED</s:key>
        <s:key name="saved_search">Alert - syslog errors last hour</s:key>
        <s:key name="savedsearchtype">savedsearch</s:key>
        <s:key name="search_app">SA-nix</s:key>
        <s:key name="search_owner">admin</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>savedsearch_Alert - syslog errors last hour_11648853</title>
    <id>https://localhost:8089/services/shcluster/captain/jobs/savedsearch_Alert%20-%20syslog%20errors%20last%20hour_11648853</id>
    <updated>2014-10-15T08:47:50-07:00</updated>
    <link href="/services/shcluster/captain/jobs/savedsearch_Alert%20-%20syslog%20errors%20last%20hour_11648853" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/jobs/savedsearch_Alert%20-%20syslog%20errors%20last%20hour_11648853" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="ATTEMPT_1">
          <s:dict>
            <s:key name="dispatch_time">1413316800</s:key>
            <s:key name="errormsg">error response peer=https://wimpy.splunk.com:55560 rc=404 reason='<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Application does not exist: SA-nix</msg>
  </messages>
</response>
'</s:key>
            <s:key name="peer">99999999-9999-9999-9999-999999999999</s:key>
            <s:key name="sid">NO_SID_RECEIVED_YET</s:key>
            <s:key name="success">0</s:key>
          </s:dict>
        </s:key>
        <s:key name="ATTEMPT_2">
          <s:dict>
            <s:key name="dispatch_time">1413316800</s:key>
            <s:key name="peer">88888888-8888-8888-8888-888888888888</s:key>
            <s:key name="sid">scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413316800_34_88888888-8888-8888-8888-888888888888</s:key>
            <s:key name="success">1</s:key>
          </s:dict>
        </s:key>
        ... eai:acl node elided ...
        <s:key name="job_state">COMPLETED</s:key>
        <s:key name="saved_search">Alert - syslog errors last hour</s:key>
        <s:key name="savedsearchtype">savedsearch</s:key>
        <s:key name="search_app">SA-nix</s:key>
        <s:key name="search_owner">admin</s:key>
      </s:dict>
    </content>
  </entry>
      .
      .
      .
<entry>
    <title>savedsearch_fired_alerts_1050236433</title>
    <id>https://localhost:8089/services/shcluster/captain/jobs/savedsearch_fired_alerts_1050236433</id>
    <updated>2014-10-15T08:47:50-07:00</updated>
    <link href="/services/shcluster/captain/jobs/savedsearch_fired_alerts_1050236433" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/jobs/savedsearch_fired_alerts_1050236433" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="ATTEMPT_1">
          <s:dict>
            <s:key name="dispatch_time">1413308100</s:key>
            <s:key name="errormsg">error response peer=https://wimpy.splunk.com:55560 rc=404 reason='<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="ERROR">Application does not exist: SA-nix</msg>
  </messages>
</response>
'</s:key>
            <s:key name="peer">99999999-9999-9999-9999-999999999999</s:key>
            <s:key name="sid">NO_SID_RECEIVED_YET</s:key>
            <s:key name="success">0</s:key>
          </s:dict>
        </s:key>
        <s:key name="ATTEMPT_2">
          <s:dict>
            <s:key name="dispatch_time">1413308100</s:key>
            <s:key name="peer">88888888-8888-8888-8888-888888888888</s:key>
            <s:key name="sid">scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413308100_2_88888888-8888-8888-8888-888888888888</s:key>
            <s:key name="success">1</s:key>
          </s:dict>
        </s:key>
        ... eai:acl node elided ...
        <s:key name="job_state">COMPLETED</s:key>
        <s:key name="saved_search">fired_alerts</s:key>
        <s:key name="savedsearchtype">savedsearch</s:key>
        <s:key name="search_app">SA-nix</s:key>
        <s:key name="search_owner">admin</s:key>
      </s:dict>
    </content>
  </entry>
</feed>


shcluster/captain/jobs/{name}

https://<host>:<mPort>/services/shcluster/captain/jobs/{name}


GET

Get running and recently finished jobs for {name} cluster.


Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Name Description
ATTEMPT_[n] dispatch_time - The UTC time of dispatch for the job
errormsg - If the job failed, capturing the reason for failure
peer - GUID of the member that the job was sent to
sid - the search id of this attempt
success - a boolean for success/failure of the job
job_state Job State can be SCHEDULED/DISPATCHED/COMPLETED. A SCHEDULED job has been received by the captain from the scheduler to schedule. A DISPATCHED job has started to run on a remote member. A COMPLETED job has finished running on the remote member.
saved_search The name of the saved-search from the associated savedsearches.conf file.
savedsearchtype The scheduler manages three kinds of scheduled jobs, regular savedsearch for both realtime and historical, autosummary report acceleration build searches, and tsidx tsidx build searches.
search_app The application in which the savedsearch was created.
search_owner The owner of the saved search.


Example request and response
XML Request

curl -k -u admin:pass https://localhost:8089/services/shcluster/captain/jobs/scheduled_sample%20scheduled%20search%20for%20dashboards%20%28existing%20job%20case%29%20timechart_12944444515

XML Response

  <title>shclustercaptainjobs</title>
  <id>https://localhost:8089/services/shcluster/captain/jobs</id>
  <updated>2016-07-22T13:56:18-07:00</updated>
  <generator build="d6d01722fce508a9e2f032d36d8d6a445b7d6292" version="20160721"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/shcluster/captain/jobs/_new" rel="create"/>
  <link href="/services/shcluster/captain/jobs/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>scheduled_sample scheduled search for dashboards (existing job case) timechart_1290934515</title>
    <id>https://localhost:8089/services/shcluster/captain/jobs/scheduled_sample%20scheduled%20search%20for%20dashboards%20%28existing%20job%20case%29%20timechart_1290934515</id>
    <updated>2016-07-22T13:56:18-07:00</updated>
    <link href="/services/shcluster/captain/jobs/scheduled_sample%20scheduled%20search%20for%20dashboards%20%28existing%20job%20case%29%20timechart_1294444515" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/jobs/scheduled_sample%20scheduled%20search%20for%20dashboards%20%28existing%20job%20case%29%20timechart_12904444515" rel="list"/>
    <link href="/services/shcluster/captain/jobs/scheduled_sample%20scheduled%20search%20for%20dashboards%20%28existing%20job%20case%29%20timechart_12909444515" rel="edit"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="dispatch_time">1469214120</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:attributes">
          <s:dict>
            <s:key name="optionalFields">
              <s:list/>
            </s:key>
            <s:key name="requiredFields">
              <s:list/>
            </s:key>
            <s:key name="wildcardFields">
              <s:list/>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="job_state">COMPLETED</s:key>
        <s:key name="peer">11111111-1111-1111-1111-111111111111</s:key>
        <s:key name="peer_scheme_host_port">https://wimpy:13221</s:key>
        <s:key name="peer_servername">home-1</s:key>
        <s:key name="saved_search">sample scheduled search for dashboards (existing job case) timechart</s:key>
        <s:key name="savedsearchtype">scheduled</s:key>
        <s:key name="search_app">testing</s:key>
        <s:key name="search_owner">nobody</s:key>
        <s:key name="sid">scheduler__nobody__testing__RMD5058c22ce2c07889b_at_1469214120_39_11111111-1111-1111-1111-111111111111</s:key>
        <s:key name="success">1</s:key>
      </s:dict>
    </content>
  </entry>


shcluster/captain/members

https://<host>:<mPort>/services/shcluster/captain/members

Lists the search head cluster members.


GET

List cluster members.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
adhoc_searchhead Flag to indicate if this member does not run scheduled searches.
advertise_restart_required Flag to indicate if this peer advertised that it needed a restart.
artifact_count Number of artifacts on this peer
delayed_artifacts_to_discard List of artifacts waiting to be deleted from this peer.
fixup_set N/A
host_port_pair The host and management port advertised by this peer.
kv_store_host_port Host and port of the kv store instance of this member.
label The name for this member. Displayed on the Splunk Web manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer
peer_scheme_host_port URI of the current captain.
pending_job_count Used by the captain to keep track of pending jobs requested by the captain to this member.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
site N/A
status Indicates the status of the member. Possible values are the following.
  • Up
  • Down
  • Pending
  • Detention
  • Restarting
  • DecommAwaitPeer
  • DecommFixingBuckets
  • Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status. Possible values are the following.
Complete
Complete (warm/cold) bucket
NonStreamingTarget
Target of replication for already completed (warm/cold) bucket
PendingTruncate
Bucket pending truncation
PendingDiscard
Bucket pending discard
Standalone
Bucket that is not replicated
StreamingError
Copy of streaming bucket where some error was encountered
StreamingSource
Streaming hot bucket on source side
StreamingTarget
Streaming hot bucket copy on target side
Unset
Uninitialized


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/captain/members

XML Response


<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustercaptainmembers</title>
  <id>https://localhost:8089/services/shcluster/captain/members</id>
  <updated>2014-10-15T08:49:34-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/shcluster/captain/members/_new" rel="create"/>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/captain/members/88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:49:34-07:00</updated>
    <link href="/services/shcluster/captain/members/88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/members/88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/captain/members/88888888-8888-8888-8888-888888888888" rel="edit"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="adhoc_searchhead">0</s:key>
        <s:key name="advertise_restart_required">0</s:key>
        <s:key name="artifact_count">4</s:key>
        <s:key name="delayed_artifacts_to_discard">
          <s:list/>
        </s:key>
        ... eai:acl node elided ...
        <s:key name="fixup_set">
          <s:list/>
        </s:key>
        <s:key name="host_port_pair">localhost:8089</s:key>
        <s:key name="kv_store_host_port">?</s:key>
        <s:key name="label">searchhead</s:key>
        <s:key name="last_heartbeat">1413388171</s:key>
        <s:key name="peer_scheme_host_port">https://localhost:8089</s:key>
        <s:key name="pending_job_count">0</s:key>
        <s:key name="replication_count">0</s:key>
        <s:key name="replication_port">3456</s:key>
        <s:key name="replication_use_ssl">0</s:key>
        <s:key name="site">site2</s:key>
        <s:key name="status">Up</s:key>
        <s:key name="status_counter">
          <s:dict>
            <s:key name="Complete">4</s:key>
            <s:key name="PendingDiscard">0</s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>99999999-9999-9999-9999-999999999999</title>
    <id>https://localhost:8089/services/shcluster/captain/members/99999999-9999-9999-9999-999999999999</id>
    <updated>2014-10-15T08:49:34-07:00</updated>
    <link href="/services/shcluster/captain/members/99999999-9999-9999-9999-999999999999" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/members/99999999-9999-9999-9999-999999999999" rel="list"/>
    <link href="/services/shcluster/captain/members/99999999-9999-9999-9999-999999999999" rel="edit"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="adhoc_searchhead">0</s:key>
        <s:key name="advertise_restart_required">0</s:key>
        <s:key name="artifact_count">4</s:key>
        <s:key name="delayed_artifacts_to_discard">
          <s:list/>
        </s:key>
        ... eai:acl node elided ...
        <s:key name="fixup_set">
          <s:list/>
        </s:key>
        <s:key name="host_port_pair">wimpy.splunk.com:55560</s:key>
        <s:key name="kv_store_host_port">?</s:key>
        <s:key name="label">master</s:key>
        <s:key name="last_heartbeat">1413388171</s:key>
        <s:key name="peer_scheme_host_port">https://wimpy.splunk.com:55560</s:key>
        <s:key name="pending_job_count">0</s:key>
        <s:key name="replication_count">0</s:key>
        <s:key name="replication_port">55570</s:key>
        <s:key name="replication_use_ssl">0</s:key>
        <s:key name="site">site1</s:key>
        <s:key name="status">Up</s:key>
        <s:key name="status_counter">
          <s:dict>
            <s:key name="Complete">4</s:key>
            <s:key name="NonStreamingTarget">0</s:key>
            <s:key name="PendingDiscard">0</s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
</feed>

shcluster/captain/members/{name}

https://<host>:<mPort>/services/shcluster/captain/members/{name}

Get information about the {name} searchhead cluster member.


GET

Get information about the {name} searchhead cluster member.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
adhoc_searchhead Flag to indicate if this member does not run scheduled searches.
advertise_restart_required Flag to indicate if this peer advertised that it needed a restart.
artifact_count Number of artifacts on this peer.
delayed_artifacts_to_discard List of artifacts waiting to be deleted from this peer.
fixup_set N/A
host_port_pair The host and management port advertised by this peer.
kv_store_host_port Host and port of the kv store instance of this member.
label The name for this member. Displayed on the Splunk Web manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer
peer_scheme_host_port URI of the current captain.
pending_job_count Used by the master to keep track of pending jobs requested by the master to this peer.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
site N/A
status Indicates the status of the member.

Possible values are the following.

  • Up
  • Down
  • Pending
  • Detention
  • Restarting
  • DecommAwaitPeer
  • DecommFixingBuckets
  • Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status. Possible values are the following.
Complete
Complete (warm/cold) bucket
NonStreamingTarget
Target of replication for already completed (warm/cold) bucket
PendingTruncate
Bucket pending truncation
PendingDiscard
Bucket pending discard
Standalone
Bucket that is not replicated
StreamingError
Copy of streaming bucket where some error was encountered
StreamingSource
Streaming hot bucket on source side
StreamingTarget
Streaming hot bucket copy on target side
Unset
Uninitialized


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/shcluster/captain/members/33333333-3333-3333-3333-333333333333

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustercaptainmembers</title>
  <id>https://wimpy:13221/services/shcluster/captain/members</id>
  <updated>2016-07-22T14:12:50-07:00</updated>
  <generator build="d6d01722fce508a9e2f032d36d8d6a445b7d6292" version="20160721"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/shcluster/captain/members/_new" rel="create"/>
  <link href="/services/shcluster/captain/members/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>33333333-3333-3333-3333-333333333333</title>
    <id>https://localhost:8089/services/shcluster/captain/members/33333333-3333-3333-3333-333333333333</id>
    <updated>2016-07-22T14:12:50-07:00</updated>
    <link href="/services/shcluster/captain/members/33333333-3333-3333-3333-333333333333" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/captain/members/33333333-3333-3333-3333-333333333333" rel="list"/>
    <link href="/services/shcluster/captain/members/33333333-3333-3333-3333-333333333333" rel="edit"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="adhoc_searchhead">0</s:key>
        <s:key name="advertise_restart_required">0</s:key>
        <s:key name="artifact_count">6</s:key>
        <s:key name="delayed_artifacts_to_discard">
          <s:list/>
        </s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:attributes">
          <s:dict>
            <s:key name="optionalFields">
              <s:list>
                <s:item>advertise_restart_required</s:item>
                <s:item>advertise_restart_required_reason</s:item>
                <s:item>alert_csv</s:item>
                <s:item>alert_csv_epoch</s:item>
                <s:item>artifacts_location_csv</s:item>
                <s:item>completed_summaries</s:item>
                <s:item>last_oaep</s:item>
                <s:item>last_osep</s:item>
                <s:item>partial_alert_delta</s:item>
                <s:item>partial_suppression_delta</s:item>
                <s:item>peer_load_stats_gla_15m</s:item>
                <s:item>peer_load_stats_gla_1m</s:item>
                <s:item>peer_load_stats_gla_5m</s:item>
                <s:item>peer_load_stats_max_runtime</s:item>
                <s:item>peer_load_stats_num_autosummary</s:item>
                <s:item>peer_load_stats_num_historical</s:item>
                <s:item>peer_load_stats_num_realtime</s:item>
                <s:item>peer_load_stats_num_running</s:item>
                <s:item>peer_load_stats_total_runtime</s:item>
                <s:item>peer_pid</s:item>
                <s:item>scheduler_disabled</s:item>
                <s:item>suppression_csv</s:item>
                <s:item>suppression_csv_epoch</s:item>
              </s:list>
            </s:key>
            <s:key name="requiredFields">
              <s:list>
                <s:item>last_artifact_log_entry_processed</s:item>
                <s:item>last_si_entry_processed</s:item>
                <s:item>mgmt_port</s:item>
                <s:item>peer_load_stats</s:item>
                <s:item>queue_blocked_count</s:item>
              </s:list>
            </s:key>
            <s:key name="wildcardFields">
              <s:list/>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="fixup_set">
          <s:list/>
        </s:key>
        <s:key name="host_port_pair">wimpy:13223</s:key>
        <s:key name="is_captain">0</s:key>
        <s:key name="kv_store_host_port">wimpy:18323</s:key>
        <s:key name="label">wimpy-3</s:key>
        <s:key name="last_heartbeat">1469221966</s:key>
        <s:key name="mgmt_uri">https://wimpy:13223</s:key>
        <s:key name="no_artifact_replications">0</s:key>
        <s:key name="peer_scheme_host_port">https://wimpy:13223</s:key>
        <s:key name="pending_job_count">0</s:key>
        <s:key name="preferred_captain">1</s:key>
        <s:key name="replication_count">0</s:key>
        <s:key name="replication_port">12243</s:key>
        <s:key name="replication_use_ssl">0</s:key>
        <s:key name="site">default</s:key>
        <s:key name="status">Up</s:key>
        <s:key name="status_counter">
          <s:dict>
            <s:key name="Complete">6</s:key>
            <s:key name="NonStreamingTarget">0</s:key>
            <s:key name="PendingDiscard">0</s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>
</feed>

shcluster/config

https://<host>:<mPort>/services/shcluster/config

List searchhead cluster node configuration.


GET

List searchhead cluster node configuration.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
cxn_timeout Low-level timeout, in seconds, for establishing connection between searchhead cluster nodes. Defaults to 60 seconds.
disabled Indicates if this node is disabled.
heartbeat_period Only valid for member nodes in a searchhead cluster. The time, in seconds, that a member attempts to send a heartbeat to the captain
heartbeat_timeout Only valid for the captain node in a searchhead cluster configuration. The time, in seconds, before a captain considers a member down. Once a member is down, the captain initiates steps to replicate artifacts from the dead member to its live members. Defaults to 60 seconds.
id Id of the SH cluster this member is a part of.
max_peer_rep_load Maximum number of replications that can be ongoing as a target.
mode slave | searchhead | disabled) Defaults to disabled.

Sets operational mode for this searchhead cluster node. Only one captain may exist per searchhead cluster.

percent_peers_to_restart Percentage of peers to restart at the same time when doing a rolling restart.
ping_flag For internal use to facilitate communication between the captain and members.
quiet_period The time, in seconds, that a captain waits for members to add themselves to the searchhead cluster.
rcv_timeout Low-level timeout, in seconds, for receiving data between searchhead cluster nodes. Defaults to 60 seconds.
register_replication_address Valid only for nodes configured as members. The address on which a member is available for accepting replication data. This is useful in the cases where a member host machine has multiple interfaces and only one of them can be reached by another splunkd instance.
rep_cxn_timeout Low-level timeout, in seconds, for establishing a connection for replicating data.
rep_max_rcv_timeout Maximum cumulative time, in seconds, for receiving acknowledgement data from members. Defaults to 600s.
rep_max_send_timeout Maximum time, in seconds, for sending replication slice data between searchhead cluster nodes. Defaults to 600s.
rep_rcv_timeout Low-level timeout, in seconds, for receiving data between searchhead cluster nodes.
rep_send_timeout Low-level timeout, in seconds, for sending replication data between searchhead cluster nodes. Defaults to 5 seconds.
replication_factor Only valid for nodes configured as a captain.

Determines how many copies of raw data are created in the searchhead cluster. This could be less than the number of searchhead cluster members.

Must be greater than 0 and greater than or equal to the search factor. Defaults to 3.

replication_port TCP port to listen for replicated data from another searchhead cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
restart_timeout Only valid for nodes configured as a captain. The amount of time, in seconds, the captain waits for a member to come back when the member is restarted (to avoid the overhead of trying to fix the artifacts that were on the member). Defaults to 600 seconds.

Note: This only works if the member is restarted from Splunk Web.

secret Secret shared among the nodes in the searchhead cluster to prevent any arbitrary node from connecting to the searchhead cluster. If a member or searchhead is not configured with the same secret as the captain, it is not able to communicate with the captain.

Corresponds to pass4SymmKey setting in server.conf.

send_timeout Low-level timeout, in seconds, for sending data between searchhead cluster nodes. Defaults to 60 seconds.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/config

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclusterconfig</title>
  <id>https://localhost:8089/services/shcluster/config</id>
  <updated>2014-10-15T08:50:47-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/shcluster/config/_reload" rel="_reload"/>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>config</title>
    <id>https://localhost:8089/services/shcluster/config/config</id>
    <updated>2014-10-15T08:50:47-07:00</updated>
    <link href="/services/shcluster/config/config" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/config/config" rel="list"/>
    <link href="/services/shcluster/config/config/_reload" rel="_reload"/>
    <link href="/services/shcluster/config/config" rel="edit"/>
    <link href="/services/shcluster/config/config/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="cxn_timeout">60</s:key>
        <s:key name="disabled">0</s:key>
        ... eai:acl node elided ...
        <s:key name="heartbeat_period">5</s:key>
        <s:key name="heartbeat_timeout">60</s:key>
        <s:key name="id">BB3116C0-73B9-459A-B473-254A18A69776</s:key>
        <s:key name="max_peer_rep_load">5</s:key>
        <s:key name="mode">dynamic_captain</s:key>
        <s:key name="percent_peers_to_restart">10</s:key>
        <s:key name="ping_flag">1</s:key>
        <s:key name="quiet_period">60</s:key>
        <s:key name="rcv_timeout">60</s:key>
        <s:key name="register_replication_address"></s:key>
        <s:key name="rep_cxn_timeout">60</s:key>
        <s:key name="rep_max_rcv_timeout">600</s:key>
        <s:key name="rep_max_send_timeout">600</s:key>
        <s:key name="rep_rcv_timeout">60</s:key>
        <s:key name="rep_send_timeout">60</s:key>
        <s:key name="replication_factor">2</s:key>
        <s:key name="replication_port">3456</s:key>
        <s:key name="replication_use_ssl">0</s:key>
        <s:key name="restart_timeout">60</s:key>
        <s:key name="secret">********</s:key>
        <s:key name="send_timeout">60</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

shcluster/member/artifacts

https://<host>:<mPort>/services/shcluster/member/artifacts

Manage searchhead cluster member artifact configuration.


GET

List searchhead cluster members artifact configuration.


Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
For each member:

Name Description
status Indicates the status of this artifact. Possible values are as follows.
Complete
The copy of this artifact contains the full complement of information.
StreamingSource
The copy of this artifact is sending data to member nodes for replication.
StreamingTarget
The copy of this artifact is receiving replicated data.
NonStreamingTarget
This copy of a warm artifact replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError
The copy of this artifact encountered errors while streaming data.
PendingTruncate
The captain asked the member to truncate this copy of the artifact to a certain size and is waiting for confirmation.
PendingDiscard
The captain asked the member to discard this copy of the artifact and is waiting for confirmation.
Standalone
An artifact in the searchhead cluster that is not replicated.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/artifacts

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustermemberartifacts</title>
  <id>https://localhost:8089/services/shcluster/member/artifacts</id>
  <updated>2014-10-15T08:51:46-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:51:46-07:00</updated>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413381600_268_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        <s:key name="status">Complete</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:51:46-07:00</updated>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413385200_281_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        <s:key name="status">Complete</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387900_290_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387900_290_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:51:46-07:00</updated>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387900_290_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387900_290_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413387900_290_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        <s:key name="status">Complete</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413388200_291_88888888-8888-8888-8888-888888888888</title>
    <id>https://localhost:8089/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413388200_291_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-15T08:51:46-07:00</updated>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413388200_291_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413388200_291_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD5b9b800e209365567_at_1413388200_291_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        <s:key name="status">Complete</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

shcluster/member/artifacts/{name}

https://<host>:<mPort>/services/shcluster/member/artifacts/{name}

Get {name} member artifact configuration.


GET

List {name} member artifact information.


Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Name Description
status Indicates the status of this artifact. Possible values are as follows.
Complete
The copy of this artifact contains the full complement of information.
StreamingSource
The copy of this artifact is sending data to member nodes for replication.
StreamingTarget
The copy of this artifact is receiving replicated data.
NonStreamingTarget
This copy of a warm artifact replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError
The copy of this artifact encountered errors while streaming data.
PendingTruncate
The captain asked the member to truncate this copy of the artifact to a certain size and is waiting for confirmation.
PendingDiscard
The captain asked the member to discard this copy of the artifact and is waiting for confirmation.
Standalone
An artifact in the searchhead cluster that is not replicated.


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413518400_762_88888888-8888-8888-8888-888888888888

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustermemberartifacts</title>
  <id>https://localhost:8089/services/shcluster/member/artifacts</id>
  <updated>2014-10-16T22:33:37-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413518400_762_88888888-8888-8888-8888-888888888888</title>
    <id>https://wimpy.splunk.com:55569/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413518400_762_88888888-8888-8888-8888-888888888888</id>
    <updated>2014-10-16T22:33:37-07:00</updated>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413518400_762_88888888-8888-8888-8888-888888888888" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413518400_762_88888888-8888-8888-8888-888888888888" rel="list"/>
    <link href="/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413518400_762_88888888-8888-8888-8888-888888888888" rel="remove"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        ... eai:attributes node elided ...
        <s:key name="status">Complete</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

shcluster/member/consensus

https://<host>:<mPort>/services/shcluster/member/consensus

Get latest cluster configuration from the raft consensus protocol.


GET

Get latest cluster configuration from the raft consensus protocol.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values
These values are returned for each member.

Name Description
configuration_id Unique id for this configuration.
servers_list Comma-separated list of members that are part of the cluster. Each member is listed as scheme://host:port


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/consensus

XML Response

<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustermemberconsensus</title>
  <id>https://localhost:8089/services/shcluster/member/consensus</id>
  <updated>2014-10-15T08:52:28-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>shc_cluster_configuration</title>
    <id>https://localhost:8089/services/shcluster/member/consensus/shc_cluster_configuration</id>
    <updated>2014-10-15T08:52:28-07:00</updated>
    <link href="/services/shcluster/member/consensus/shc_cluster_configuration" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/member/consensus/shc_cluster_configuration" rel="list"/>
    <link href="/services/shcluster/member/consensus/shc_cluster_configuration" rel="edit"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="configuration_id">4</s:key>
        ... eai:acl node elided ...
        <s:key name="servers_list">https://localhost:55560,https://localhost:55569</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

shcluster/member/info

https://<host>:<mPort>/services/shcluster/member/info

Access searchhead cluster member node information.


GET

List member information.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values
These values are returned for each member.

Name Description
adhoc_searchhead Flag that indicates if this member can run scheduled searches.
is_registered Indicates if this member is registered with the searchhead cluster captain.
last_heartbeat_attempt Timestamp for the last attempt to contact the captain.
maintenance_mode N/A
peer_load_stats_gla_15m Number of scheduled searches run in the last 15 minutes.
peer_load_stats_gla_1m Number of scheduled searches run in the last one minute.
peer_load_stats_gla_5m Number of scheduled searches run in the last five minutes.
peer_load_stats_max_runtime N/A
peer_load_stats_num_autosummary N/A
peer_load_stats_num_historical N/A
peer_load_stats_num_realtime N/A
peer_load_stats_num_running N/A
peer_load_stats_total_runtime N/A
restart_state Indicates whether the member needs to be restarted to enable its searchhead cluster configuration.
status Indicates the status of the member. Possible values are as follows.
  • Up
  • Down
  • Pending
  • Detention
  • Restarting
  • DecommAwaitingPeer
  • DecommFixingBuckets
  • Decommissioned


Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/info

XML Response


<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>shclustermemberinfo</title>
  <id>https://localhost:8089/services/shcluster/member/info</id>
  <updated>2014-10-15T08:53:07-07:00</updated>
  <generator build="235980" version="20141014"/>
  <author>
    <name>Splunk</name>
  </author>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>member</title>
    <id>https://localhost:8089/services/shcluster/member/info/member</id>
    <updated>2014-10-15T08:53:07-07:00</updated>
    <link href="/services/shcluster/member/info/member" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/shcluster/member/info/member" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="adhoc_searchhead">0</s:key>
        ... eai:acl node elided ...
        <s:key name="is_registered">1</s:key>
        <s:key name="last_heartbeat_attempt">1413388386</s:key>
        <s:key name="maintenance_mode">0</s:key>
        <s:key name="peer_load_stats_gla_15m">3</s:key>
        <s:key name="peer_load_stats_gla_1m">0</s:key>
        <s:key name="peer_load_stats_gla_5m">1</s:key>
        <s:key name="peer_load_stats_max_runtime">0.000000</s:key>
        <s:key name="peer_load_stats_num_autosummary">0</s:key>
        <s:key name="peer_load_stats_num_historical">0</s:key>
        <s:key name="peer_load_stats_num_realtime">0</s:key>
        <s:key name="peer_load_stats_num_running">0</s:key>
        <s:key name="peer_load_stats_total_runtime">0.000000</s:key>
        <s:key name="restart_state">NoRestart</s:key>
        <s:key name="status">Up</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

PREVIOUS
Application endpoint examples
  NEXT
Cluster endpoint examples

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters