Splunk® Enterprise

REST API Reference Manual

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Deployment endpoint descriptions

Manage deployment servers and clients.

A deployment server configures a deployment client. Deployment clients and servers can reside on separate, distributed, Splunk instances or can reside on the same instance.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

App and user context

Typically, knowledge objects, such as saved searches or event types, have an app/user context that is the namespace. For more information about specifying a namespace, see Namespace in the REST API User Manual.

Splunk Cloud limitations

If you have a managed Splunk Cloud deployment with search head clustering and index clustering, the REST API supports access to the search head only. You can use the REST API to interact with the search head in your deployment. Using the REST API to access any other cluster member nodes is not supported. For example, deployment endpoints are not applicable to Splunk Cloud deployments.

See Using the REST API in Splunk Cloud in the the Splunk REST API Tutorials for more information.


deployment/client

https://<host>:<mPort>/services/deployment/client

List deployment client configuration and status.


GET

Get deployment client list with enabled status, server class, and host and port number of each.


Request parameters
Pagination and filtering parameters can be used with this method.

Returned values

For each deployment client, the following values are returned.

Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled
serverClasses List of member server classes for app download authorization.
targetUri Host and port number (<host>:<port>).

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/client

XML Response

...
 <title>deploymentclient</title>
 <id>https://localhost:8089/services/deployment/client</id>
 <updated>2011-07-11T00:35:37-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>deployment-client</title>
   <id>https://localhost:8089/services/deployment/client/deployment-client</id>
   <updated>2011-07-11T00:35:37-07:00</updated>
   <link href="/services/deployment/client/deployment-client" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/client/deployment-client" rel="list"/>
   <link href="/services/deployment/client/deployment-client" rel="edit"/>
   <link href="/services/deployment/client/deployment-client/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
       <s:key name="serverClasses">
         <s:list>
           <s:item>dstest:dstestapp</s:item>
         </s:list>
       </s:key>
       <s:key name="targetUri">essplunk:8089</s:key>
     </s:dict>
   </content>
 </entry>




deployment/client/config

https://<host>:<mPort>/services/deployment/client/config


Get deployment client configuration and status.


GET

Get deployment client enabled status, server class for app distribution, and host and port number.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled
serverClasses List of member server classes for app download authorization.
targetUri Host and port number (<host>:<port>).

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/client/config

XML Response

 <title>deploymentclient</title>
 <id>https://localhost:8089/services/deployment/client</id>
 <updated>2013-07-31T20:49:58-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/client/listIsDisabled" rel="listIsDisabled"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>config</title>
   <id>https://localhost:8089/services/deployment/client/config</id>
   <updated>2013-07-31T20:49:58-07:00</updated>
   <link href="/services/deployment/client/config" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/client/config" rel="list"/>
   <link href="/services/deployment/client/config" rel="edit"/>
   <link href="/services/deployment/client/config/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
       ... eai:attributes node elided ...
       <s:key name="serverClasses">
         <s:list>
           <s:item>sc_apps_wma:wma-app2</s:item>
           <s:item>sc_apps_wma:wma-app1</s:item>
           <s:item>sc_mach_type:wma-app2</s:item>
           <s:item>sc_new:wma-app2</s:item>
           <s:item>sc_new:wma-app1</s:item>
         </s:list>
       </s:key>
       <s:key name="targetUri">localhost:8089</s:key>
     </s:dict>
   </content>
 </entry>



deployment/client/config/listIsDisabled

https://<host>:<mPort>/services/deployment/client/config/listIsDisabled


Get deployment client status.

GET

Get deployment client disabled status.


Request parameters
None


Returned values

Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/client/config/listIsDisabled

XML Response

...
 <title>deploymentclient</title>
 <id>https://localhost:8089/services/deployment/client</id>
 <updated>2013-08-04T18:49:25-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/client/listIsDisabled" rel="listIsDisabled"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>default</title>
   <id>https://localhost:8089/services/deployment/client/default</id>
   <updated>2013-08-04T18:49:25-07:00</updated>
   <link href="/services/deployment/client/default" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/client/default" rel="list"/>
   <link href="/services/deployment/client/default" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
     </s:dict>
   </content>
 </entry>



deployment/client/config/reload

Access information on reloading the named client.


POST

Access client reload information.

Request parameters
No parameters for this request.


Returned values

Status Code Description
200 Endpoint returned successfully.
400 Request error. See response body for details.
401 Authentication failure: must pass valid credentials with request.
403 Insufficient permissions to access resource.
404 Specified resoruce does not exist.
409 Request error: this operation is invalid for this item. See response body for details.
500 Internal server error. See response body for details.


Example request and response


XML Request

curl -k -u admin:pass -X POST https://localhost:8089/services/deployment/client/config/reload

XML Response

...
 <title>deploymentclient</title>
 <id>https://localhost:8089/services/deployment/client</id>
 <updated>2013-10-07T15:49:06-07:00</updated>
 <generator build="182462" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/client/listIsDisabled" rel="listIsDisabled"/>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>config</title>
   <id>https://localhost:8089/services/deployment/client/config</id>
   <updated>2013-10-07T15:49:06-07:00</updated>
   <link href="/services/deployment/client/config" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/client/config" rel="list"/>
   <link href="/services/deployment/client/config" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">1</s:key>
       ... eai:acl node elided ...
     </s:dict>
   </content>
 </entry>



deployment/client/{name}/reload

https://<host>:<mPort>/services/deployment/client/{name}/reload

Restart and reload the {name} deployment client.


POST

Restart and reload {name} deployment client.


Request parameters
None

Returned values

Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled
serverClasses List of member server classes for app download authorization.
targetUri Host and port number (<host>:<port>).


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/client/deployment-client/reload

XML Response

...
 <title>deploymentclient</title>
 <id>https://localhost:8089/services/deployment/client</id>
 <updated>2011-07-11T00:39:23-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>deployment-client</title>
   <id>https://localhost:8089/services/deployment/client/deployment-client</id>
   <updated>2011-07-11T00:39:23-07:00</updated>
   <link href="/services/deployment/client/deployment-client" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/client/deployment-client" rel="list"/>
   <link href="/services/deployment/client/deployment-client" rel="edit"/>
   <link href="/services/deployment/client/deployment-client/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
       <s:key name="serverClasses">
         <s:list>
           <s:item>dstest:dstestapp</s:item>
         </s:list>
       </s:key>
       <s:key name="targetUri">tiny:8089</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/applications

https://<host>:<mPort>/services/deployment/server/applications

List distributed apps.


GET

List distributed apps, including distributed state information.


Request parameters

Name Type Default Description
clientId String Select apps that match clientId.
hasDeploymentError Boolean Select apps according to deployment fault status:
0 = Do not include apps with a deployment fault indication.
1 = Include apps with a deployment fault indication.

Pagination and filtering parameters can be used with this method.


Returned values
The response includes these values for each app listed.

Name Description
archive Disk location of the archived version of the app.
clientId Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes.
hasDeploymentError Indicates deployment fault status on at least one deployment client:
0 = Do not include apps with a deployment fault indication.
1 = Include apps with a deployment fault indication.
loadtime Last deployment server app loaded or reloaded date and time. An application not mapped to serverclasses is not loaded so loadtime is 0.
restartSplunkWeb Restart Splunk Web indication:
0 = Do not restart Splunk Web.
1 = Restart Splunk Web.
restartSplunkd Restart splunkd indication:
0 = Do not restart splunkd.
1 = Restart splunkd.
serverclasses List of server classes associated with the application.
size Size on disk of the compressed app (bundle), in bytes.
stateOnClient App enablement status:
0 = Not enabled.
1 = Enabled.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/applications

XML Response

...
 <title>applications</title>
 <id>https://localhost:8089/services/deployment/server/applications</id>
 <updated>2013-08-01T09:35:22-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/applications/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>wma-app-test2</title>
   <id>https://localhost:8089/services/deployment/server/applications/wma-app2</id>
   <updated>2013-08-01T09:35:22-07:00</updated>
   <link href="/services/deployment/server/applications/wma-app2" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <content type="text/xml">
     <s:dict>
       <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app2-1375305443.bundle</s:key>
       ... eai:acl node elided ...
       <s:key name="loadtime">Wed Jul 31 14:17:23 2013</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="serverclasses">
         <s:list>
           <s:item>sc_mach_type</s:item>
           <s:item>sc_new</s:item>
           <s:item>sc_apps_wma</s:item>
         </s:list>
       </s:key>
       <s:key name="size">112640</s:key>
       <s:key name="stateOnClient">enabled</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>wma-app1</title>
   <id>https://localhost:8089/services/deployment/server/applications/wma-app1</id>
   <updated>2013-08-01T09:35:22-07:00</updated>
   <link href="/services/deployment/server/applications/wma-app_test1" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <content type="text/xml">
     <s:dict>
       <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app1-1375305443.bundle</s:key>
       ... eai:acl node elided ...
       <s:key name="loadtime">Wed Jul 31 14:17:23 2013</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="serverclasses">
         <s:list>
           <s:item>sc_new</s:item>
           <s:item>sc_apps_wma</s:item>
         </s:list>
       </s:key>
       <s:key name="size">112640</s:key>
       <s:key name="stateOnClient">enabled</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/applications/{name}

https://<host>:<mPort>/services/deployment/server/applications/{name}

Get or update distribution information for {name} app.


GET

Get {name} app distribution information.


Request parameters
None

Returned values

Name Description
archive Disk location of archived version of the app.
clientId Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes.
hasDeploymentError Indicates deployment fault status on at least one deployment client:
0 = Do not include apps with a deployment fault indication.
1 = Include apps with a deployment fault indication.
loadtime Last deployment server app loaded or reloaded date and time. An application not mapped to serverclasses is not loaded so loadtime is 0.
restartSplunkWeb Restart Splunk Web indication:
0 = Do not restart Splunk Web.
1 = Restart Splunk Web.
restartSplunkd Restart splunkd indication:
0 = Do not restart splunkd.
1 = Restart splunkd.
serverclasses List of server classes associated with the application.
size Size on disk of the compressed app (bundle), in bytes.
stateOnClient App enablement status:
0 = Not enabled.
1 = Enabled.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/applications/wma-app1

XML Response

...
 <title>applications</title>
 <id>https://localhost:8089/services/deployment/server/applications</id>
 <updated>2013-08-04T18:53:50-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/applications/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>wma-app1</title>
   <id>https://localhost:8089/services/deployment/server/applications/wma-app1</id>
   <updated>2013-08-04T18:53:50-07:00</updated>
   <link href="/services/deployment/server/applications/wma-app1" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <content type="text/xml">
     <s:dict>
       <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app1-1375467593.bundle</s:key>
       ... eai:acl node elided ...
       <s:key name="eai:attributes">... elided ...</s:key>
       <s:key name="loadtime">Fri Aug  2 11:19:53 2013</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="serverclasses">
         <s:list>
           <s:item>sc_new</s:item>
           <s:item>sc_apps_wma</s:item>
         </s:list>
       </s:key>
       <s:key name="size">112640</s:key>
       <s:key name="stateOnClient">enabled</s:key>
     </s:dict>
   </content>
 </entry>



POST

Update {name} app distribution information.

Usage details
When continueMatching is true, matching is in the order in which server classes are defined.

The whitelist setting indicates a filtering strategy that includes a subset.

  • Items are not considered to match the server class by default.
  • Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
  • Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.

The blacklist setting indicates a filtering strategy that excludes a subset.

  • Items are considered to match the server class by default.
  • Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
  • Items that match any whitelist entry are considered to match the server class.

That is,

whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable

If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.


Request parameters

Name Type Default Description
blacklist.* String List of hosts to exclude when mapping application to a server class. For each blacklist, replace the wildcard (*) with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.
continueMatching Boolean Configuration layering indication, across classes and server-specific settings:
true = [Default] Configuration lookups continue matching server classes after the first match.
false = Use the first match, only.
deinstall Boolean Remove mapping indication:
true = Remove mapping of {name} from all server classes and delete it from client target repositories.
false = Do not remove mapping of {name}.
filterType Enum Filter execution order:
whitelist = Whitelist filters are applied before blacklist filters.
blacklist = Blacklist filters are applied before whitelist filters.
machineTypesFilter String Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.

Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included.

Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter.

The patterns are PCRE regular expressions, with the following aids for easier entry:

  • You can specify '.' to mean '\\.'
  • You can specify '*' to mean '.*'
  • Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation String The location on the deployment server to store the content that is to be deployed for this server class.

For example: $SPLUNK_HOME/etc/deployment-apps

restartSplunkWeb Boolean Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.

Defaults to false

restartSplunkd Boolean Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.

Defaults to false

serverclass String The name of the server class to which the application is mapped.

Do not specify this parameter if deinstall is true.

stateOnClient Enum Valid values are (enabled | disabled | noop).
  • enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server.
  • disabled: Sets the application state to disabled on the client, regardless of state on the deployment server.
  • noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation String The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used. That is, defaults to:

$SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk deployment)

Useful only with complex (for example, tiered) deployment strategies.

tmpFolder String Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

unmap Boolean Indicates whether to remove the mapping of the application to the specified server class.
whitelist.* String List of hosts to accept for this server class.

For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.


Returned values

Name Description
archive Specifies the location of the compressed version (bundle) of the app.
blacklist.* Regular expressions used to exclude, when mapping this application to a client.

If a client matches any of the blacklist regular expressions, it does not receive the application. The * is replaced by an integral ordinal number.

continueMatching If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used.
filterType blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

See description for the filterType POST parameter for more information.

loadtime Specifies the date and time the application was last loaded (or reloaded) by the deployment server.

An application not mapped to any serverclasses does not get loaded, thus its loadtime attribute is 0; in epoch terms, which is 01 Jan 1970 at midnight GMT.

machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
serverclass The name of the server class to which the application is mapped.
serverclasses List of server classes associated with the application.
size Indicates in bytes the size on disk of the compressed version (bundle) of the application.
stateOnClient Specifies whether the deployment client is enabled or disabled.
targetRepositoryLocation The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used.

tmpFolder Working folder used by deployment server.
whitelist.* Regular expressions used to accept, when mapping this application to a client.

If a client matches any of the whitelist regular expressions, it accepts the application. The * is replaced by an integral ordinal number.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/applications/wma-app3 -d serverclass=sc_apps_wma

XML Response

...
 <title>applications</title>
 <id>https://localhost:8089/services/deployment/server/applications</id>
 <updated>2013-08-10T12:50:59-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/applications/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>wma-app3</title>
   <id>https://localhost:8089/services/deployment/server/applications/wma-app3</id>
   <updated>2013-08-10T12:50:59-07:00</updated>
   <link href="/services/deployment/server/applications/wma-app3" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <content type="text/xml">
     <s:dict>
       <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_mach_type/wma-app3-1376164259.bundle</s:key>
       ... eai:acl node elided ...
       <s:key name="loadtime">Sat Aug 10 12:50:59 2013</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="serverclasses">
         <s:list>
           <s:item>sc_mach_type</s:item>
           <s:item>sc_apps_wma</s:item>
         </s:list>
       </s:key>
       <s:key name="size">112640</s:key>
       <s:key name="stateOnClient">enabled</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/clients

https://<host>:<mPort>/services/deployment/server/clients

Provides access to information about clients to a deployment server.


GET

Access information about clients to a deployment server.


Request parameters

Name Type Default Description
action String Use one of the following values:
  • phonehome: deployment client is verifying app status (typical state)
  • unknown: app state on deployment client restart
  • download: deployment client is downloading the app or app update
  • install: deployment client is installing or updating the app
  • uninstall app removed from deployment server, marked for uninstall on the deployment client

The GET response includes all clients with an app that has the specified action.

application String Lists clients to the deployment server that have attempted to download the named application.
hasDeploymentError Boolean False Indicates whether to list only clients that have a deployment error.
maxPhonehome_latency_to_avgInterval_ratio Number List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter.
minLatestPhonehomeTime Number Lists clients for which there is a phone home message at the specified time or later, in epoch seconds. That is, list the client for the following condition:

  client latency ? (now?minLatestPhonehomeTime)

minPhonehome_latency_to_avgInterval_ratio Number List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses String Comma-separated list of serverclasses. List clients that are configured to receive an application to a listed serverclass.

The match is a logical OR of, for each Si, include C if C is sent an app A that maps to Si in serverclass.conf, if such an app existed.

The "would have" is per blacklist.n or whitelist.n/machineTypesFilter in serverclass.conf

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
applications List of applications deployed to the deployment client.
averagePhoneHomeInterval The average phone home interval, in seconds.
build The build number for the Splunk instance on the deployment client.
dns The DNS lookup name of the deployment client server.
guid Identifier for the deployment server client.
hasDeploymentError Specifies whether to check for clients with a deployment error.
hostname The host name of the deployment client server.
id ID for the client based on client name and IP address.
ip The IP address of the client to the deployment server.
lastPhoneHomeTime The last time the deployment client phones home to the deployment server, in epoch time.
mgmt The managment port for the deployment client.
minLatestPhonehomeTime Specifies in epoch seconds the minimum latency for a client to contact the deployment server.
minPhonehome_latency_to_avgInterval_ratio The minimum value specified for the ratio of the phone home latency to the average phone home interval.
name The name of the deployment client server.
serverclasses List of server classes for the deployment client.
utsname Machine type for the deployment server client.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/clients

XML Response

<title>serverclients</title>
 <id>https://localhost:8089/services/deployment/server/clients</id>
 <updated>2013-08-01T09:41:42-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/clients/countClients_by_machineType" rel="countClients_by_machineType"/>
 <link href="/services/deployment/server/clients/countRecentDownloads" rel="countRecentDownloads"/>
 <link href="/services/deployment/server/clients/getMatchingAppsForClient_dryRun" rel="getMatchingAppsForClient_dryRun"/>
 <link href="/services/deployment/server/clients/preview" rel="preview"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>dc95537d0e8fdadc44d00c50fc431e25</title>
   <id>https://localhost:8089/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25</id>
   <updated>2013-08-01T09:41:42-07:00</updated>
   <link href="/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25" rel="list"/>
   <link href="/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="applications">
         <s:dict>
           <s:key name="wma-app-test2">
             <s:dict>
               <s:key name="action">Install</s:key>
               <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app2-1375305443.bundle</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="result">Ok</s:key>
               <s:key name="serverclasses">
                 <s:list>
                   <s:item>sc_mach_type</s:item>
                   <s:item>sc_new</s:item>
                   <s:item>sc_apps_wma</s:item>
                 </s:list>
               </s:key>
               <s:key name="size">112640</s:key>
               <s:key name="stateOnClient">enabled</s:key>
               <s:key name="timestamp">Wed Jul 31 14:11:23 2013</s:key>
             </s:dict>
           </s:key>
           <s:key name="wma-app_test1">
             <s:dict>
               <s:key name="action">Install</s:key>
               <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app1-1375305443.bundle</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="result">Ok</s:key>
               <s:key name="serverclasses">
                 <s:list>
                   <s:item>sc_new</s:item>
                   <s:item>sc_apps_wma</s:item>
                 </s:list>
               </s:key>
               <s:key name="size">112640</s:key>
               <s:key name="stateOnClient">enabled</s:key>
               <s:key name="timestamp">Wed Jul 31 14:17:23 2013</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="averagePhoneHomeInterval">60</s:key>
       <s:key name="build">172889</s:key>
       <s:key name="dns">localhost.sv.splunk.com</s:key>
       ... eai:acl node elided ...
       <s:key name="guid">dc95537d0e8fdadc44d00c50fc431e25</s:key>
       <s:key name="hostname">localhost.sv.splunk.com</s:key>
       <s:key name="id">connection_10.160.24.187_8089_localhost.sv.splunk.com_localhost.sv.splunk.com_Ombra</s:key>
       <s:key name="ip">10.160.24.187</s:key>
       <s:key name="lastPhoneHomeTime">1375375291</s:key>
       <s:key name="mgmt">8089</s:key>
       <s:key name="name">Ombra</s:key>
       <s:key name="serverClasses">
         <s:dict>
           <s:key name="sc_apps_wma">
             <s:dict>
               <s:key name="loadTime">1375305443</s:key>
               <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
           <s:key name="sc_mach_type">
             <s:dict>
               <s:key name="loadTime">1375305443</s:key>
               <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
           <s:key name="sc_new">
             <s:dict>
               <s:key name="loadTime">1375305443</s:key>
               <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="utsname">linux-x86_64</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/clients/countClients_by_machineType

https://<host>:<mPort>/services/deployment/server/clients/countClients_by_machineType

Access information about deployment clients to this server according to the machine type of the client.


GET

List the count of deployment clients for this server by machine type.


Request parameters
None


Returned values

Name Description
counts The list of machine types for this deployment client, showing the count of each machine type.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/clients/countClients_by_machineType

XML Response

 <title>serverclients</title>
 <id>https://localhost:8089/services/deployment/server/clients</id>
 <updated>2013-07-30T15:07:38-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/clients/countClients_by_machineType" rel="countClients_by_machineType"/>
 <link href="/services/deployment/server/clients/countRecentDownloads" rel="countRecentDownloads"/>
 <link href="/services/deployment/server/clients/getMatchingAppsForClient_dryRun" rel="getMatchingAppsForClient_dryRun"/>
 <link href="/services/deployment/server/clients/preview" rel="preview"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>default</title>
   <id>https://localhost:8089/services/deployment/server/clients/default</id>
   <updated>2013-07-30T15:07:38-07:00</updated>
   <link href="/services/deployment/server/clients/default" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/clients/default" rel="list"/>
   <link href="/services/deployment/server/clients/default" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="counts">
         <s:dict>
           <s:key name="linux-x86_64">3</s:key>
         </s:dict>
       </s:key>
       ... eai:acl node elided ...
     </s:dict>
   </content>
 </entry>



deployment/server/clients/countRecentDownloads

https://<host>:<mPort>/services/deployment/server/clients/countRecentDownloads

Access the count of the number of downloads from this client to the deployment server during the last specified time period.


GET

Return the count of the number of downloads from this client to the deployment server during the last specified time period.


Request parameters

Name Type Default Description
application String Count the number of downloads for clients that have attempted to download the named application.
hasDeploymentError Boolean Indicates whether to count downloads for clients that have a deployment error.
maxAgeSecs
required
Number Age of the downloads to count, in seconds.
maxPhonehome_latency_to_avgInterval_ratio Number List the count of recent download by this client to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter
minLatestPhonehomeTime Number Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists the number of downloads for clients to the deployment server with a latency equal to or greater than specified by this parameter.
minPhonehome_latency_to_avgInterval_ratio Number List the number of recent downloads by clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses String Comma-separated list of server classes. Lists the number of recent downloads by clients to the deployment server that are configured to send an application to a listed serverclass.


Returned values

Name Description
count The number of recent downloads.

Example request and response


XML Request

curl -k -u admin:pass -d maxAgeSecs=1 -G https://localhost:8089/services/deployment/server/clients/countRecentDownloads

XML Response

...
 <title>serverclients</title>
 <id>https://localhost:8089/services/deployment/server/clients</id>
 <updated>2013-07-30T20:00:43-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/clients/countClients_by_machineType" rel="countClients_by_machineType"/>
 <link href="/services/deployment/server/clients/countRecentDownloads" rel="countRecentDownloads"/>
 <link href="/services/deployment/server/clients/getMatchingAppsForClient_dryRun" rel="getMatchingAppsForClient_dryRun"/>
 <link href="/services/deployment/server/clients/preview" rel="preview"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>default</title>
   <id>https://localhost:8089/services/deployment/server/clients/default</id>
   <updated>2013-07-30T20:00:43-07:00</updated>
   <link href="/services/deployment/server/clients/default" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/clients/default" rel="list"/>
   <link href="/services/deployment/server/clients/default" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="count">6</s:key>
       ... eai:acl node elided ...
     </s:dict>
   </content>
 </entry>



deployment/server/clients/{name}

https://<host>:<mPort>/services/deployment/server/clients/{name}

Get client information or remove a client.


DELETE

Remove the specified client from the deployment server registry. The next time the client "phones home" the record is re-created.


Request parameters
None


Returned values
None

Example request and response


XML Request

curl -k -u admin:pass --request DELETE https://localhost:8089/services/deployment/server/clients/1d3de43af2aae61139c367044127f44a

XML Response

...
 <title>serverclients</title>
 <id>https://qa-sv-rh61x64-7:8103/services/deployment/server/clients</id>
 <updated>2013-10-21T16:03:49-07:00</updated>
 <generator build="182785" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/clients/countClients_by_machineType" rel="countClients_by_machineType"/>
 <link href="/services/deployment/server/clients/countRecentDownloads" rel="countRecentDownloads"/>
 <link href="/services/deployment/server/clients/getMatchingAppsForClient_dryRun" rel="getMatchingAppsForClient_dryRun"/>
 <link href="/services/deployment/server/clients/preview" rel="preview"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>149685cb3e39898fbd15be6604672a31</title>
   <id>https://qa-sv-rh61x64-7:8103/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31</id>
   <updated>2013-10-21T16:03:49-07:00</updated>
   <link href="/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31" rel="list"/>
   <link href="/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="averagePhoneHomeInterval">60</s:key>
       <s:key name="build">177748</s:key>
       <s:key name="clientName">4D4EA12E-FDBA-41D3-99CD-2A61CC1DAB29</s:key>
       <s:key name="dns">qa-sv-rh61x64-10.sv.splunk.com</s:key>
       ... eai:acl node elided ...
       <s:key name="guid">149685cb3e39898fbd15be6604672a31</s:key>
       <s:key name="hostname">qa-sv-rh61x64-10</s:key>
       <s:key name="id">connection_10.160.24.224_8097_qa-sv-rh61x64-10.sv.splunk.com_qa-sv-rh61x64-10_4D4EA12E-FDBA-41D3-99CD-2A61CC1DAB29</s:key>
       <s:key name="ip">10.160.24.224</s:key>
       <s:key name="lastPhoneHomeTime">1382396628</s:key>
       <s:key name="mgmt">8097</s:key>
       <s:key name="name">4D4EA12E-FDBA-41D3-99CD-2A61CC1DAB29</s:key>
       <s:key name="serverClasses"/>
       <s:key name="utsname">linux-x86_64</s:key>
     </s:dict>
   </content>
 </entry>
 . . . elided ...



GET

Lists information about the named client to the deployment server.


Request parameters

Name Type Default Description
application String Lists information about this client with respect to the named application.
hasDeploymentError Boolean Indicates whether to list this client if has a deployment error.
maxPhonehome_latency_to_avgInterval_ratio Number List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter.
minLatestPhonehomeTime Number Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists information about the named client if it has a latency equal to or greater than specified by this parameter.
minPhonehome_latency_to_avgInterval_ratio Number List information about the named client to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses String Comma-separated list of serverclasses. Lists information about this client if it is configured to send an application to a listed serverclass.


Returned values

Name Description
application The name of the application specified to filter the results of this call.
applications List of applications deployed to the deployment client.
averagePhoneHomeInterval The average phone home interval, in seconds.
build The build number for the Splunk instance on the deployment client.
dns The DNS lookup name of the deployment client server.
guid Identifier for the deployment server client.
hasDeploymentError Specifies whether to check for clients with a deployment error.
hostname The host name of the deployment client server.
id ID for the client based on client name and IP address.
ip The IP address of the client to the deployment server.
lastPhoneHomeTime The last time the deployment client phones home to the deployment server, in epoch time.
maxPhonehome_latency_to_avgInterval_ratio The maximum value specified for the ratio of the phone home latency to the average phone home interval.
mgmt The managment port for the deployment client.
minLatestPhonehomeTime Specifies in epoch seconds the minimum latency for a client to contact the deployment server.
minPhonehome_latency_to_avgInterval_ratio The minimum value specified for the ratio of the phone home latency to the average phone home interval.
name The name of the deployment client server.
serverClasses The list of server classes to which the client belongs.
serverclasses List of server classes for the deployment client.
utsname Machine type for the deployment server client.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25

XML Response

...
 <title>serverclients</title>
 <id>https://localhost:8089/services/deployment/server/clients</id>
 <updated>2013-08-04T18:59:31-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/clients/countClients_by_machineType" rel="countClients_by_machineType"/>
 <link href="/services/deployment/server/clients/countRecentDownloads" rel="countRecentDownloads"/>
 <link href="/services/deployment/server/clients/getMatchingAppsForClient_dryRun" rel="getMatchingAppsForClient_dryRun"/>
 <link href="/services/deployment/server/clients/preview" rel="preview"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>dc95537d0e8fdadc44d00c50fc431e25</title>
   <id>https://localhost:8089/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25</id>
   <updated>2013-08-04T18:59:31-07:00</updated>
   <link href="/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25" rel="list"/>
   <link href="/services/deployment/server/clients/dc95537d0e8fdadc44d00c50fc431e25" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="applications">
         <s:dict>
           <s:key name="wma-app2">
             <s:dict>
               <s:key name="action">Unknown</s:key>
               <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app2-1375467593.bundle</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="result">Ok</s:key>
               <s:key name="serverclasses">
                 <s:list>
                   <s:item>sc_mach_type</s:item>
                   <s:item>sc_new</s:item>
                   <s:item>sc_apps_wma</s:item>
                 </s:list>
               </s:key>
               <s:key name="size">112640</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
           <s:key name="wma-app1">
             <s:dict>
               <s:key name="action">Unknown</s:key>
               <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app1-1375467593.bundle</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="result">Ok</s:key>
               <s:key name="serverclasses">
                 <s:list>
                   <s:item>sc_new</s:item>
                   <s:item>sc_apps_wma</s:item>
                 </s:list>
               </s:key>
               <s:key name="size">112640</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="averagePhoneHomeInterval">60</s:key>
       <s:key name="build">172889</s:key>
       <s:key name="dns">localhost.sv.splunk.com</s:key>
       ... eai:acl node elided ...
       ... eai:attribute node elided ...
       <s:key name="guid">dc95537d0e8fdadc44d00c50fc431e25</s:key>
       <s:key name="hostname">localhost.sv.splunk.com</s:key>
       <s:key name="id">connection_10.160.24.187_8089_localhost.sv.splunk.com_localhost.sv.splunk.com_Ombra</s:key>
       <s:key name="ip">10.160.24.187</s:key>
       <s:key name="lastPhoneHomeTime">1375667964</s:key>
       <s:key name="mgmt">8089</s:key>
       <s:key name="name">Ombra</s:key>
       <s:key name="serverClasses">
         <s:dict>
           <s:key name="sc_apps_wma">
             <s:dict>
               <s:key name="loadTime">1375467593</s:key>
               <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
           <s:key name="sc_mach_type">
             <s:dict>
               <s:key name="loadTime">1375467593</s:key>
               <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
           <s:key name="sc_new">
             <s:dict>
               <s:key name="loadTime">1375467593</s:key>
               <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="stateOnClient">enabled</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="utsname">linux-x86_64</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/config

https://<host>:<mPort>/services/deployment/server/config


Access server configuration information for deployment servers.


GET

List configuration information for all deployment servers.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
currentDownloads The number of current downloads for this deployment server.
disabled Indicates whether the deployment server is disabled.
loadTime The time, in epoch seconds, the serverclass for this server was loaded.
repositoryLocation The location on the deployment server to store the content that is to be deployed.
whitelist.0 Lists the contents of whitelist.0.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/config

XML Response

...
 <title>deploymentserver</title>
 <id>https://localhost:8089/services/deployment/server/config</id>
 <updated>2013-08-01T08:17:38-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/config/_reload" rel="_reload"/>
 <link href="/services/deployment/server/config/attributesUnsupportedInUI" rel="attributesUnsupportedInUI"/>
 <link href="/services/deployment/server/config/listIsDisabled" rel="listIsDisabled"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>config</title>
   <id>https://localhost:8089/servicesNS/nobody/system/deployment/server/config/config</id>
   <updated>2013-08-01T08:17:38-07:00</updated>
   <link href="/servicesNS/nobody/system/deployment/server/config/config" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/deployment/server/config/config" rel="list"/>
   <link href="/servicesNS/nobody/system/deployment/server/config/config/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/deployment/server/config/config" rel="edit"/>
   <link href="/servicesNS/nobody/system/deployment/server/config/config/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="currentDownloads">0</s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
       <s:key name="loadTime">1375305443</s:key>
       <s:key name="repositoryLocation">$SPLUNK_HOME/etc/deployment-apps</s:key>
       <s:key name="whitelist.0">*</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/config/attributesUnsupportedInUI

https://<host>:<mPort>/services/deployment/server/config/attributesUnsupportedInUI


Access deployment server attributes that cannot be configured from Splunk Web.


GET

Lists deployment server attributes that cannot be configured from Splunk Web.

Request parameters
None


Returned values

Name Description
property The attribute that cannot be configured from Splunk Web.
reason The reason an attribute cannot be configured from Splunk Web.
stanza In Splunk Enterprise, the stanza in serverclass.conf that lists deployment server attributes that cannot be configured from Splunk Web.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/config/attributesUnsupportedInUI

XML Response

...
 <title>deploymentserver</title>
 <id>https://localhost:8089/services/deployment/server/config</id>
 <updated>2013-08-04T19:14:20-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/config/_reload" rel="_reload"/>
 <link href="/services/deployment/server/config/attributesUnsupportedInUI" rel="attributesUnsupportedInUI"/>
 <link href="/services/deployment/server/config/listIsDisabled" rel="listIsDisabled"/>
 ... eai:acl node elided ...
 <s:messages/>
 <entry>
   <title>item_0</title>
   <id>https://localhost:8089/services/deployment/server/config/item_0</id>
   <updated>2013-08-04T19:14:20-07:00</updated>
   <link href="/services/deployment/server/config/item_0" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/config/item_0" rel="list"/>
   <link href="/services/deployment/server/config/item_0/_reload" rel="_reload"/>
   <link href="/services/deployment/server/config/item_0" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       ... opensearch nodes elided ...
       <s:key name="property">whitelist.0</s:key>
       <s:key name="reason">unsupported at this level</s:key>
       <s:key name="stanza">global</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/config/listIsDisabled

https://<host>:<mPort>/services/deployment/server/config/listIsDisabled

Access deployment server enablement status.


GET

Access deployment server enablement status.


Request parameters
None


Request parameters

Name Description
disabled Indicates if the deployment server is disabled.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/config/listIsDisabled

XML Response

...
 <title>deploymentserver</title>
 <id>https://localhost:8089/services/deployment/server/config</id>
 <updated>2013-08-10T14:08:11-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/config/_reload" rel="_reload"/>
 <link href="/services/deployment/server/config/attributesUnsupportedInUI" rel="attributesUnsupportedInUI"/>
 <link href="/services/deployment/server/config/listIsDisabled" rel="listIsDisabled"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>default</title>
   <id>https://localhost:8089/services/deployment/server/config/default</id>
   <updated>2013-08-10T14:08:11-07:00</updated>
   <link href="/services/deployment/server/config/default" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/config/default" rel="list"/>
   <link href="/services/deployment/server/config/default/_reload" rel="_reload"/>
   <link href="/services/deployment/server/config/default" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
     </s:dict>
   </content>
 </entry>



deployment/server/serverclasses

https://<host>:<mPort>/services/deployment/server/serverclasses

Access information about server classes.


GET

List server classes for this deployment server.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
blacklist-size The number of entires in the blacklist for this serverclass.
clientId ID of deployment client for this server class.
currentDownloads Number of applications currently downloaded.
hasDeploymentError Indicates whether the serverclass has at least one deployment error.
loadTime The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList List of applications stored at the location specified by repositoryLocation.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
stateOnClient Indicates whether this server class is enabled or disabled.
whitelist-size Specifies the number of entries in the whitelist for this server class.
whitelist.0 List of servers for whitelist.0 for this server class.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/serverclasses

XML Response

...
 <title>serverclasses</title>
 <id>https://localhost:8089/services/deployment/server/serverclasses</id>
 <updated>2013-08-01T09:50:16-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/serverclasses/_new" rel="create"/>
 <link href="/services/deployment/server/serverclasses/rename" rel="rename"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>sc_apps_wma</title>
   <id>https://localhost:8089/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma</id>
   <updated>2013-08-01T09:50:16-07:00</updated>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="list"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="edit"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="remove"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_apps_wma/applications" rel="applications"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_apps_wma/clients" rel="clients"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_apps_wma/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="blacklist-size">0</s:key>
       <s:key name="currentDownloads">0</s:key>
       ... eai:acl node elided ...
       <s:key name="loadTime">1375305443</s:key>
       <s:key name="machineTypesFilter"></s:key>
       <s:key name="repositoryList">
         <s:dict>
           <s:key name="wma-app2"/>
           <s:key name="wma-app1"/>
         </s:dict>
       </s:key>
       <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="stateOnClient">enabled</s:key>
       <s:key name="whitelist-size">1</s:key>
       <s:key name="whitelist.0">Ombra*</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>sc_mach_type</title>
   <id>https://localhost:8089/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type</id>
   <updated>2013-08-01T09:50:16-07:00</updated>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="list"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="edit"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="remove"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_mach_type/applications" rel="applications"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_mach_type/clients" rel="clients"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_mach_type/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="blacklist-size">0</s:key>
       <s:key name="currentDownloads">0</s:key>
       ... eai:acl node elided ...
       <s:key name="loadTime">1375305443</s:key>
       <s:key name="machineTypesFilter">linux-x86_64,</s:key>
       <s:key name="repositoryList">
         <s:dict>
           <s:key name="wma-app-test2"/>
           <s:key name="wma-app_test1"/>
         </s:dict>
       </s:key>
       <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="stateOnClient">enabled</s:key>
       <s:key name="whitelist-size">1</s:key>
       <s:key name="whitelist.0">Ombra*</s:key>
     </s:dict>
   </content>
 </entry>



POST

Create a server class.


Request parameters

Name Type Default Description
name
required
String The name of the server class.
blacklist.* String List of hosts to exclude for this server class.

For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.

continueMatching Boolen Controls how configuration is layered across classes and server-specific settings.

If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true.

A serverClass can override this property and stop the matching.

filterType Enum Valid values: (whitelist | blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

The whitelist setting indicates a filtering strategy that pulls in a subset:

  • Items are not considered to match the server class by default.
  • Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
  • Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.

The blacklist setting indicates a filtering strategy that rules out a subset:

  • Items are considered to match the server class by default.
  • Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
  • Items that match any whitelist entry are considered to match the server class.

More briefly:

whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable

If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.

machineTypesFilter String Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.

Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included.

Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter.

The patterns are PCRE regular expressions, with the following aids for easier entry:

  • You can specify '.' to mean '\\.'
  • You can specify '*' to mean '.*'
  • Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation String The location on the deployment server to store the content that is to be deployed for this server class.

For example: $SPLUNK_HOME/etc/deployment-apps

restartSplunkWeb Boolean Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.

Defaults to false

restartSplunkd Boolean Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.

Defaults to false

stateOnClient Enum Valid values are (enabled | disabled | noop).
  • enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server.
  • disabled: Sets the application state to disabled on the client, regardless of state on the deployment server.
  • noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation String The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used. That is, defaults to:

$SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance

Useful only with complex (for example, tiered) deployment strategies.


tmpFolder String Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

whitelist.* String List of hosts to accept for this server class.

For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.

Returned values

Name Description
blacklist-size The number of entries in the blacklist for this serverclass.
blacklist.* Regular expressions used to exclude for this server class.

If a client matches any of the blacklist regular expressions, it is not included in the server class. The * is replaced by an integral ordinal number.

continueMatching If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used.
currentDownloads Number of applications currently downloaded.
filterType blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

See description for the filterType POST parameter for more information.

loadTime The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList List of applications stored at the location specified by repositoryLocation.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
stateOnClient Specifies whether the deployment client is enabled or disabled.
targetRepositoryLocation The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used.

That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk deployment.

Useful only with complex (for example, tiered) deployment strategies.

tmpFolder Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

whitelist-size Specifies the number of entries in the whitelist for this server class.
whitelist.* Regular expressions used to accept for this server class.

If a client matches any of the whitelist regular expressions, it is included in the server class. The * is replaced by an integral ordinal number.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/serverclasses -d name=sc_apps_ombra

XML Response

...
 <title>serverclasses</title>
 <id>https://localhost:8089/services/deployment/server/serverclasses</id>
 <updated>2013-08-10T13:18:28-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/serverclasses/_new" rel="create"/>
 <link href="/services/deployment/server/serverclasses/rename" rel="rename"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>sc_apps_ombra</title>
   <id>https://localhost:8089/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_ombra</id>
   <updated>2013-08-10T13:18:28-07:00</updated>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_ombra" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_ombra" rel="list"/>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_ombra" rel="edit"/>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_ombra" rel="remove"/>
   <link href="/servicesNS/nobody/search/deployment/serverclasses/sc_apps_ombra/applications" rel="applications"/>
   <link href="/servicesNS/nobody/search/deployment/serverclasses/sc_apps_ombra/clients" rel="clients"/>
   <link href="/servicesNS/nobody/search/deployment/serverclasses/sc_apps_ombra/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="blacklist-size">0</s:key>
       <s:key name="currentDownloads">0</s:key>
       ... opensearch nodes elided ...
       <s:key name="loadTime">1376165908</s:key>
       <s:key name="machineTypesFilter"></s:key>
       <s:key name="repositoryList">
         <s:dict>
           <s:key name="wma-app-test2"/>
           <s:key name="wma-app3"/>
           <s:key name="wma-app_test1"/>
         </s:dict>
       </s:key>
       <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="stateOnClient">enabled</s:key>
       <s:key name="whitelist-size">0</s:key>
     </s:dict>
   </content>
 </entry>



deployment/server/serverclasses/rename

https://<host>:<mPort>/services/deployment/server/serverclasses/rename

Rename a server class.


POST

Specify a new name for a server class.


Request parameters

Name Type Default Description
newName
required
String The new name of the server class.
oldName
required
String The current name of the server class.


Returned values
None


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/serverclasses/rename -d oldName=sc_apps_ombra -d newName=sc_apps_shadow

XML Response

...
 <title>serverclasses</title>
 <id>https://localhost:8089/services/deployment/server/serverclasses</id>
 <updated>2013-10-09T08:54:09-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/serverclasses/_new" rel="create"/>
 <link href="/services/deployment/server/serverclasses/rename" rel="rename"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>sc_apps_shadow</title>
   <id>https://localhost:8089/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_shadow</id>
   <updated>2013-10-09T08:54:09-07:00</updated>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_shadow" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_shadow" rel="list"/>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_shadow" rel="edit"/>
   <link href="/servicesNS/nobody/search/deployment/server/serverclasses/sc_apps_shadow" rel="remove"/>
   <link href="/servicesNS/nobody/search/deployment/serverclasses/sc_apps_shadow/applications" rel="applications"/>
   <link href="/servicesNS/nobody/search/deployment/serverclasses/sc_apps_shadow/clients" rel="clients"/>
   <link href="/servicesNS/nobody/search/deployment/serverclasses/sc_apps_shadow/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="blacklist-size">0</s:key>
       <s:key name="currentDownloads">0</s:key>
       ... eai:acl node elided ...
       <s:key name="loadTime">1381334049</s:key>
       <s:key name="machineTypesFilter"></s:key>
       <s:key name="repositoryList">
         <s:dict>
           <s:key name="tmp"/>
           <s:key name="wma-app-test2"/>
           <s:key name="wma-app3"/>
           <s:key name="wma-app_test1"/>
         </s:dict>
       </s:key>
       <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="stateOnClient">enabled</s:key>
       <s:key name="whitelist-size">0</s:key>
     </s:dict>
   </content>
 </entry>




deployment/server/serverclasses/{name}

https://<host>:<mPort>/services/deployment/server/serverclasses/{name}

Manage the {name} serverclass.


DELETE

Remove the specfied server class from this deployment server.


Request parameters
None


Returned values
None

Example request and response


XML Request

curl -k -u admin:pass --request DELETE https://localhost:8089/services/deployment/server/serverclasses/sc_apps_shadow

XML Response

...
 <title>serverclasses</title>
 <id>https://localhost:8089/services/deployment/server/serverclasses</id>
 <updated>2013-10-09T09:13:27-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/serverclasses/_new" rel="create"/>
 <link href="/services/deployment/server/serverclasses/rename" rel="rename"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>sc_apps_wma</title>
   <id>https://localhost:8089/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma</id>
   <updated>2013-10-09T09:13:27-07:00</updated>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="list"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="edit"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_apps_wma" rel="remove"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_apps_wma/applications" rel="applications"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_apps_wma/clients" rel="clients"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_apps_wma/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="blacklist-size">0</s:key>
       <s:key name="currentDownloads">0</s:key>
       ... eai:acl node elided ...
       <s:key name="loadTime">1381335207</s:key>
       <s:key name="machineTypesFilter"></s:key>
       <s:key name="repositoryList">
         <s:dict>
           <s:key name="tmp"/>
           <s:key name="wma-app-test2"/>
           <s:key name="wma-app3"/>
           <s:key name="wma-app_test1"/>
         </s:dict>
       </s:key>
       <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="stateOnClient">enabled</s:key>
       <s:key name="whitelist-size">1</s:key>
       <s:key name="whitelist.0">Ombra*</s:key>
     </s:dict>
   </content>
 </entry>
 ... elided ...



GET

List information about the named server class.


Request parameters

Name Type Default Description
clientId String GUID of a deployment client that is a member of the named server class. Lists information about the named server class with respect to this client.
hasDeploymentError Boolean Indicates whether to only list server classes that have a deployment error.


Returned values

Name Description
blacklist-size Specifies the size of the blacklist for the named server class.
clientId ID of deployment client for this server class.
currentDownloads The number of entires in the blacklist for this serverclass.
hasDeploymentError Indicates whether the serverclass has at least one deployment error.
loadTime The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList List of applications stored at the location specified by repositoryLocation.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
stateOnClient Indicates whether this server class is enabled or disabled.
whitelist-size Specifies the number of entries in the whitelist for this server class.
whitelist.0 List of servers for whitelist.0 for this server class.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/serverclasses/sc_mach_type

XML Response

...
 <title>serverclasses</title>
 <id>https://localhost:8089/services/deployment/server/serverclasses</id>
 <updated>2013-08-04T19:19:34-07:00</updated>
 <generator build="172889" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/serverclasses/_new" rel="create"/>
 <link href="/services/deployment/server/serverclasses/rename" rel="rename"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>sc_mach_type</title>
   <id>https://localhost:8089/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type</id>
   <updated>2013-08-04T19:19:34-07:00</updated>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="list"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="edit"/>
   <link href="/servicesNS/nobody/system/deployment/server/serverclasses/sc_mach_type" rel="remove"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_mach_type/applications" rel="applications"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_mach_type/clients" rel="clients"/>
   <link href="/servicesNS/nobody/system/deployment/serverclasses/sc_mach_type/reload" rel="reload"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="blacklist-size">0</s:key>
       <s:key name="currentDownloads">0</s:key>
       ... eai:acl node elided ...
       <s:key name="eai:attributes">... elided ...</s:key>
       <s:key name="loadTime">1375467593</s:key>
       <s:key name="machineTypesFilter">linux-x86_64,</s:key>
       <s:key name="repositoryList">
         <s:dict>
           <s:key name="wma-app2"/>
           <s:key name="wma-app1"/>
         </s:dict>
       </s:key>
       <s:key name="repositoryLocation">/opt/cluster/peer1/splunk/etc/deployment-apps</s:key>
       <s:key name="restartSplunkWeb">0</s:key>
       <s:key name="restartSplunkd">0</s:key>
       <s:key name="stateOnClient">enabled</s:key>
       <s:key name="whitelist-size">1</s:key>
       <s:key name="whitelist.0">Ombra*</s:key>
     </s:dict>
   </content>
 </entry>



POST

Update the named server class.


Request parameters

Name Type Default Description
blacklist.* String List of hosts to exclude for this server class.

For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.

continueMatching Boolen Controls how configuration is layered across classes and server-specific settings.

If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true.

A serverClass can override this property and stop the matching.

filterType Enum Valid values: (whitelist | blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

The whitelist setting indicates a filtering strategy that pulls in a subset:

  • Items are not considered to match the server class by default.
  • Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
  • Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.

The blacklist setting indicates a filtering strategy that rules out a subset:

  • Items are considered to match the server class by default.
  • Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
  • Items that match any whitelist entry are considered to match the server class.

More briefly:

whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable

If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.

machineTypesFilter String Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.

Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included.

Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter.

The patterns are PCRE regular expressions, with the following aids for easier entry:

  • You can specify '.' to mean '\\.'
  • You can specify '*' to mean '.*'
  • Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation String The location on the deployment server to store the content that is to be deployed for this server class.

For example: $SPLUNK_HOME/etc/deployment-apps

restartSplunkWeb Boolean Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.

Defaults to false

restartSplunkd Boolean Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.

Defaults to false

stateOnClient Enum Valid values are (enabled | disabled | noop).
  • enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server.
  • disabled: Sets the application state to disabled on the client, regardless of state on the deployment server.
  • noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation String The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used. That is, defaults to:

$SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance

Useful only with complex (for example, tiered) deployment strategies.


tmpFolder String Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

whitelist.* String List of hosts to accept for this server class.

For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.


Returned values
None

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/deployment/server/serverclasses/sc_apps_ombra -d stateOnClient=noop

XML Response

 <title>serverclasses</title>
 <id>https://localhost:8089/services/deployment/server/serverclasses</id>
 <updated>2013-08-10T13:24:16-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/serverclasses/_new" rel="create"/>
 <link href="/services/deployment/server/serverclasses/rename" rel="rename"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>sc_apps_ombra</title>
   <id>https://localhost:8089/services/deployment/server/serverclasses/sc_apps_ombra</id>
   <updated>2013-08-10T13:24:16-07:00</updated>
   <link href="/services/deployment/server/serverclasses/sc_apps_ombra" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/serverclasses/sc_apps_ombra" rel="list"/>
   <link href="/services/deployment/server/serverclasses/sc_apps_ombra" rel="edit"/>
   <link href="/services/deployment/server/serverclasses/sc_apps_ombra" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       ... opensearch nodes elided ...
     </s:dict>
   </content>
 </entry>



search/distributed/bundle-replication-files

https://<host>:<mPort>/services/search/distributed/bundle-replication-files

Access information for the most recent distributed search bundle.


GET

List distributed search bundle replication files.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
checksum Common checksum for entities in the bundle.
filename Bundle file name
location Bundle file path
size Bundle size, in bytes
timestamp Bundle creation timestamp.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/search/distributed/bundle-replication-files

XML Response

...
 <title>search-head-bundles</title>
 <id>https://localhost:8089/services/search/distributed/bundle-replication-files</id>
 <updated>2013-10-09T09:42:51-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>13134207368020721783</title>
   <id>https://localhost:8089/services/search/distributed/bundle-replication-files/13134207368020721783</id>
   <updated>2013-10-09T09:42:51-07:00</updated>
   <link href="/services/search/distributed/bundle-replication-files/13134207368020721783" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/search/distributed/bundle-replication-files/13134207368020721783" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="checksum">13134207368020721783</s:key>
       ... eai:acl node elided ...
       <s:key name="filename">localhost-1381336958.bundle</s:key>
       <s:key name="location">/opt/cluster/peer1/splunk/var/run/localhost-1381336958.bundle</s:key>
       <s:key name="timestamp">1381336958</s:key>
     </s:dict>
   </content>
 </entry>



search/distributed/bundle-replication-files/{name}

https://<host>:<mPort>/services/search/distributed/bundle-replication-files/{name}

Get {name} bundle replication file information.


GET

List information about the specified bundle replication file. For {name}, specify the checksum for the file.


Request parameters

Name Type Default Description
force_list_all Boolean Indicates whether to force a listing of the file.


Returned values
None


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/search/distributed/bundle-replication-files/13134207368020721783

XML Response

...
 <title>search-head-bundles</title>
 <id>https://localhost:8089/services/search/distributed/bundle-replication-files</id>
 <updated>2013-10-09T10:07:17-07:00</updated>
 <generator build="176231" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>13134207368020721783</title>
   <id>https://localhost:8089/services/search/distributed/bundle-replication-files/13134207368020721783</id>
   <updated>2013-10-09T10:07:17-07:00</updated>
   <link href="/services/search/distributed/bundle-replication-files/13134207368020721783" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/search/distributed/bundle-replication-files/13134207368020721783" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="checksum">13134207368020721783</s:key>
       ... eai:acl node elided ...
       <s:key name="eai:attributes">... elided ...</s:key>
       <s:key name="filename">localhost-1381336958.bundle</s:key>
       <s:key name="location">/opt/cluster/peer1/splunk/var/run/localhost-1381336958.bundle</s:key>
       <s:key name="timestamp">1381336958</s:key>
     </s:dict>
   </content>
 </entry>



search/distributed/config

https://<host>:<mPort>/services/search/distributed/config


Provides access to the Splunk Enterprise distributed search options. This option is not for adding search peers.

GET

Lists the configuration options for the distributed search system.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
autoAddServers [Deprecated]
blacklistNames List of filenames that match the blacklist pattern, and are not replicated.
blacklistURLs List of URLs that are blacklisted, and thus is not replicated.
checkTimedOutServersFrequency Rechecks servers at the specified frequency (in seconds). If this is set to 0, then no recheck occurs. Defaults to 60.

This attribute is ONLY relevant if removeTimedOutServers is set to true. If removeTimedOutServers is false, this attribute is ignored.

connectionTimeout Connection timeout.
disabled Indicates if the distributed search is disabled.
dist_search_enabled Indicates if the distributed search is enabled.
heartbeatFrequency [Deprecated]
heartbeatMcastAddr [Deprecated]
heartbeatPort [Deprecated]
receiveTimeout Amount of time in seconds to use as a timeout while trying to read/receive data from a search peer.
removedTimedOutServers If true, removes a server connection that cannot be made within serverTimeout.

If false, every call to that server attempts to connect. This may result in a slow user interface.

sendTimeout Send timeout.
serverTimeout [Deprecated] Refer to connectionTimeout, sendTimeout, and receiveTimeout.
servers The initial list of servers.

If operating completely in autoAddServers mode (discovering all servers), there is no need to list any servers here.

shareBundles Indicates whether this server uses bundle replication to share search time configuration with search peers.

If set to false, the search head assumes that the search peers can access the correct bundles using an NFS share and have correctly configured the options listed under: "SEARCH HEAD BUNDLE MOUNTING OPTIONS."

skipOurselves [Deprecated]
statusTimeout Set connection timeout when gathering a search peer's basic info (/services/server/info). Read/write timeouts are automatically set to twice this value.
ttl [Deprecated]

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/search/distributed/config

XML Response

...
 <title>distsearch-setup</title>
 <id>https://localhost:8089/services/search/distributed/config</id>
 <updated>2011-07-10T23:21:51-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>distributedSearch</title>
   <id>https://localhost:8089/services/search/distributed/config/distributedSearch</id>
   <updated>2011-07-10T23:21:51-07:00</updated>
   <link href="/services/search/distributed/config/distributedSearch" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/search/distributed/config/distributedSearch" rel="list"/>
   <link href="/services/search/distributed/config/distributedSearch" rel="edit"/>
   <link href="/services/search/distributed/config/distributedSearch" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="autoAddServers">0</s:key>
       <s:key name="blacklistNames"/>
       <s:key name="blacklistURLs"/>
       <s:key name="checkTimedOutServersFrequency">60</s:key>
       <s:key name="disabled">0</s:key>
       <s:key name="dist_search_enabled">1</s:key>
       ... eai:acl node elided ...
       <s:key name="heartbeatFrequency">0</s:key>
       <s:key name="heartbeatMcastAddr">224.0.0.37</s:key>
       <s:key name="heartbeatPort">8888</s:key>
       <s:key name="removedTimedOutServers">0</s:key>
       <s:key name="serverTimeout">10</s:key>
       <s:key name="servers"/>
       <s:key name="shareBundles">1</s:key>
       <s:key name="skipOurselves">0</s:key>
       <s:key name="statusTimeout">10</s:key>
       <s:key name="ttl">1</s:key>
     </s:dict>
   </content>
 </entry>



search/distributed/peers

https://<host>:<mPort>/services/search/distributed/peers


Provides distributed peer server management. A search peer is defined as a Splunk server to which another Splunk server distributes searches. The Splunk server where the search request originates is referred to as the search head.


GET

Get configured search peers to which this search head is configured to distribute searches. This includes configured but disabled search peers.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
build The Splunk build number for this peer.
bundle_versions The IDs of the bundles (of this search head) that the peer has.

The IDs are sorted from latest to earliest.

disabled Indicates if the peer is disabled.
guid GUID of the peer.
is_https Inidcates if the management port is using SSL.
licenseSignature The license signature.
peerName The Splunk server name of the peer.
peerType Specifies whether the peer is configured or discovered.
replicationStatus The status of bundle replication to this peer. Can be any of the following values:
Initial
In progress
Failed
Successful
Mounted
status The status of the peer.

Can be one of the following values:

Up
Down
Blacklisted
Not a Splunk server
Free Splunk server
Authentication Failed
Duplicate License
Duplicate Servername
Inconsistent bundles
status_details Details of any errors encountered in the last heartbeat period.
version The Splunk software version string this peer is running.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/search/distributed/peers

XML Response

...
 <title>distsearch-peer</title>
 <id>https://localhost:8089/services/search/distributed/peers</id>
 <updated>2011-07-11T18:21:48-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/search/distributed/peers/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>tiny:8090</title>
   <id>https://localhost:8089/services/search/distributed/peers/tiny%3A8090</id>
   <updated>2011-07-11T18:21:48-07:00</updated>
   <link href="/services/search/distributed/peers/tiny%3A8090" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/search/distributed/peers/tiny%3A8090" rel="list"/>
   <link href="/services/search/distributed/peers/tiny%3A8090" rel="edit"/>
   <link href="/services/search/distributed/peers/tiny%3A8090" rel="remove"/>
   <link href="/services/search/distributed/peers/tiny%3A8090/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="build"/>
       <s:key name="bundle_versions">
         <s:list/>
       </s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl node elided ...
       <s:key name="guid"/>
       <s:key name="is_https">1</s:key>
       <s:key name="licenseSignature"/>
       <s:key name="peerName">tiny:8090</s:key>
       <s:key name="peerType">configured</s:key>
       <s:key name="replicationStatus">Initial</s:key>
       <s:key name="status">Down</s:key>
       <s:key name="version"/>
     </s:dict>
   </content>
 </entry>


POST

Add a new distributed search peer.

Usage details
The distributed search must first be enabled using the search/distributed/config endpoint.

Request parameters

Name Type Required Default Description
name String
The name of the search peer.

Defined as hostname:port, where port is the management port.

remotePassword String
The password of the remote user.
remoteUsername String
The username of a user with admin privileges in the search peer server.

This is used to exchange certificates.


HTTP response codes

Status Code Description
201 Created successfully.
400 Request error. See response body for details.
401 Authentication failure: must pass valid credentials with request.
402 The Splunk license in use has disabled this feature.
403 Insufficient permissions to create specified resource.
409 Request error: this operation is invalid for this item. See response body for details.
500 Internal server error. See response body for details.
503 This feature has been disabled in Splunk configuration files.


Returned values
No values returned for this request.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/search/distributed/peers -d name=MrT:8092 -d remoteUsername=admin -d remotePassword=mypass

XML Response

.
.
.
 <title>distsearch-peer</title>
 <id>https://localhost:8089/services/search/distributed/peers</id>
 <updated>2011-07-11T18:22:00-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/search/distributed/peers/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>



search/distributed/peers/{name}

https://<host>:<mPort>/services/search/distributed/peers

Manage distributed peer servers. A search peer is defined as a Splunk server to which another Splunk server distributes searches. The Splunk server where the search request originates is referred to as the search head.


POST

Update a peer server.


Usage details
The distributed search must first be enabled using the search/distributed/config endpoint.

Request parameters

Name Type Required Default Description
remotePassword String
The password of the remote user.
remoteUsername String
The username of a user with admin privileges in the search peer server.

This is used to exchange certificates.


Returned values
See example.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/search/distributed/peers/MrT:8092  -d remoteUsername=admin -d remotePassword=mypass

XML Response

.
.
.
 <title>distsearch-peer</title>
 <id>https://localhost:8089/services/search/distributed/peers</id>
 <updated>2011-07-11T18:22:00-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/search/distributed/peers/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>




Last modified on 11 January, 2021
PREVIOUS
Configuration endpoint descriptions
  NEXT
Input endpoint descriptions

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters