Skip to main content
Splunk Cloud Platform™

REST API Reference Manual

Splunk Cloud Platform™
9.1.2312
This documentation does not apply to the most recent version of Splunk Cloud Platform™. For documentation on the most recent version, go to the latest release.

Federated search endpoint descriptions

Use the federated search REST API endpoints to create, update, and delete definitions for federated providers and federated indexes for Federated Search for Splunk and Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform.

See Overview of the federated search options for the Splunk platform in Federated Search.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication are required for access to endpoints and REST operations.

Splunk users must have role or capability-based authorization to use REST endpoints, and must have the admin_all_objects and edit_indexes capabilities to use the federated search endpoints detailed in this topic.

Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls > Users. To determine the capabilities assigned to a role, select Settings > Access controls > Roles.

Splunk Cloud Platform URL for REST API access

Splunk Cloud Platform has a different host and management port syntax than Splunk Enterprise. Paid subscribers to the Splunk Cloud Platform service use the following URL to access REST API resources: 

https://<deployment-name>.splunkcloud.com:8089

See Access requirements and limitations for the Splunk Cloud Platform REST API in the the REST API Tutorials manual for more information.

data/federated/settings/general

https://<host>:<mPort>/services/data/federated/settings/general

Use this endpoint to review the general settings for your Splunk platform deployment implementation of Federated Search for Splunk and change those settings as necessary. For an overview of Federated Search for Splunk, see About Federated Search for Splunk in Federated Search.

The settings that this endpoint governs do not apply to Federated Search for Amazon S3.

Authentication and authorization
Usage of the GET and POST operations for this endpoint is restricted to roles that have the admin_all_objects capability.

GET

Expand

Provides the current general federated search settings for your Splunk platform deployment.

POST

Expand

Updates general federated search settings. Can be used to turn federated search functionality on or off for a Splunk platform deployment.

data/federated/provider

https://<host>:<mPort>/services/data/federated/provider

Use this endpoint to get a list of federated providers and post new federated provider definitions. Some of these settings are exclusive to Federated Search for Splunk, while other settings are exclusive to Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform.

The provider endpoint does not honor user or app context. It always places federated provider stanzas in etc/system/local/federated.conf, no matter which user or app namespace you are currently using.

For more information about defining federated providers for Federated Search for Splunk, see Define a Splunk platform federated provider in Federated Search.

For more information about defining federated providers for Federated Search for Amazon S3, see Define an Amazon S3 federated provider in Federated Search.

Authentication and authorization
Usage of the POST operation for this endpoint is restricted to roles that have the admin_all_objects capability.

GET

Expand

Returns a list of federated providers.

POST

Expand

Creates a new federated provider definition.

data/federated/provider/turnOffProvidersInBatch

https://<host>:<mPort>/services/data/federated/provider/turnOffProvidersInBatch

Use this endpoint to turn off groups of federated providers with one REST API call. This endpoint applies to federated providers for Federated Search for Splunk and Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform.

When federated providers are turned off, their federated indexes are unavailable for federated searches.

After you turn off a group of federated providers with this endpoint, individually turn each deactivated federated provider back on with the data/federated/provider/{federated_provider_name}/enable endpoint.

The provider endpoint does not honor user or app context. It always places federated provider stanzas in etc/system/local/federated.conf, no matter which user or app namespace you are currently using.

For more information about defining federated providers for Federated Search for Splunk, see Define a Splunk platform federated provider in Federated Search.

For more information about defining federated providers for Federated Search for Amazon S3, see Define an Amazon S3 federated provider in Federated Search.

Authentication and authorization
Usage of the POST operation for this endpoint is restricted to roles that have the admin_all_objects capability.

POST

Expand

Turns off all federated providers. Can also turn off all federated providers belonging to a specific federated search type.

data/federated/provider/{federated_provider_name}

https://<host>:<mPort>/services/data/federated/provider/{federated_provider_name}

Use this endpoint to:

  • Retrieve a specific federated provider definition.
  • Update a specific federated provider definition.
  • Delete a specific federated provider definition.

Some of the settings you can review and update with these endpoints are exclusive to Federated Search for Splunk, while other settings are exclusive to Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform deployments.

The provider endpoint does not honor user or app context. It always places federated provider stanzas in etc/system/local/federated.conf, no matter which user or app namespace you are currently using.

For more information about defining federated providers for Federated Search for Splunk, see Define a Splunk platform federated provider in Federated Search.

For more information about defining federated providers for Federated Search for Amazon S3, see Define an Amazon S3 federated provider in Federated Search.

Authentication and Authorization
Usage of the POST and DELETE operations for this endpoint is restricted to roles that have the admin_all_objects capability.

GET

Expand

Returns a definition of a specific {federated_provider_name}.

POST

Expand

Updates a definition for a specific {federated_provider_name}.

DELETE

Expand

Deletes a definition for a specific {federated_provider_name}.

data/federated/provider/{federated_provider_name}/disable

https://<host>:<mPort>/services/data/federated/provider/{federated_provider_name}/disable

Use this endpoint to turn a specific federated provider off. When a federated provider is turned off, all federated indexes associated with that provider are not searchable in federated searches. This endpoint applies to federated providers for Federated Search for Splunk and for Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform deployments.

The provider endpoint does not honor user or app context. It always places federated provider stanzas in etc/system/local/federated.conf, no matter which user or app namespace you are currently using.

For more information about federated providers for Federated Search for Splunk, see Define a Splunk platform federated provider in Federated Search.

For more information about federated providers for Federated Search for Amazon S3, see Define an Amazon S3 federated provider in Federated Search.

Authentication and Authorization
Usage of the POST operation for this endpoint is restricted to roles that have the admin_all_objects capability.

POST

Expand

Turn off a specific federated provider.

data/federated/provider/{federated_provider_name}/enable

https://<host>:<mPort>/services/data/federated/provider/{federated_provider_name}/enable

Use this endpoint to turn a federated provider back on after you have turned it off. When a federated provider is turned on, all federated indexes associated with that provider can be searched in federated searches. This endpoint applies to federated providers for Federated Search for Splunk and federated providers for Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform deployments.

The provider endpoint does not honor user or app context. It always places federated provider stanzas in etc/system/local/federated.conf, no matter which user or app namespace you are currently using.

For more information about federated providers for Federated Search for Splunk, see Define a Splunk platform federated provider in Federated Search.

For more information about federated providers for Federated Search for Amazon S3, see Define an Amazon S3 federated provider in Federated Search.

Authentication and Authorization
Usage of the POST operation for this endpoint is restricted to roles that have the admin_all_objects capability.

POST

Expand

Turns a specific federated index on.

data/federated/index

https://<host>:<mPort>/services/data/federated/index

Use this endpoint to get a list of federated indexes and post new federated index definitions. Some of these federated index settings are exclusive to Federated Search for Splunk, while others are exclusive to Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform.

For more information about defining federated indexes for Federated Search for Splunk, see Map a federated index to a remote Splunk dataset in Federated Search.

For more information about defining federated indexes for Federated Search for Amazon S3, see Map a federated index to an AWS Glue Data Catalog table dataset in Federated Search.

Authentication and authorization
Usage of the POST operation for this endpoint is restricted to roles that have the admin_all_objects and indexes_edit capabilities.

GET

Expand

Returns a list of federated indexes.

POST

Expand

Creates a new federated index definition.

data/federated/index/{federated_index_name}

https://<host>:<mPort>/services/data/federated/provider/{federated_index_name}

Use this endpoint to:

  • Retrieve a specific federated index definition.
  • Update a specific federated index definition.
  • Delete a specific federated index definition.

Some of these federated index settings are exclusive to Federated Search for Splunk, while others are exclusive to Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform.

For more information about defining federated indexes for Federated Search for Splunk, see Map a federated index to a remote Splunk dataset in Federated Search.

For more information about defining federated indexes for Federated Search for Amazon S3, see Map a federated index to an AWS Glue Data Catalog table dataset in Federated Search.

Authentication and Authorization
Usage of the POST and DELETE operations for this endpoint is restricted to roles that have the admin_all_objects and indexes_edit capabilities.

GET

Expand

Returns a definition of a specific {federated_index_name}.

POST

Expand

Updates a definition for a specific {federated_index_name}.

DELETE

Expand

Deletes a definition for a specific {federated_index_name}.

data/federated/index/{federated_index_name}/disable

https://<host>:<mPort>/services/data/federated/index/{federated_index_name}/disable

Use this endpoint to turn a specific federated index off. When a federated index is turned off, that federated index is not searchable in federated searches. This endpoint applies to federated indexes for Federated Search for Splunk and for Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform deployments.

For more information about defining federated indexes for Federated Search for Splunk, see Map a federated index to a remote Splunk dataset in Federated Search.

For more information about defining federated indexes for Federated Search for Amazon S3, see Map a federated index to an AWS Glue Data Catalog table dataset in Federated Search.

Authentication and Authorization
Usage of the POST operation for this endpoint is restricted to roles that have the admin_all_objects capability.

POST

Expand

Turn off a specific federated index.

data/federated/index/{federated_index_name}/enable

https://<host>:<mPort>/services/data/federated/index/{federated_index_name}/enable

Use this endpoint to turn a federated index back on after you have turned it off. When a federated index is turned on, it can be searched in federated searches. This endpoint applies to federated indexes for Federated Search for Splunk and federated indexes for Federated Search for Amazon S3. Federated Search for Amazon S3 is available only for Splunk Cloud Platform deployments.

For more information about defining federated indexes for Federated Search for Splunk, see Map a federated index to a remote Splunk dataset in Federated Search.

For more information about defining federated indexes for Federated Search for Amazon S3, see Map a federated index to an AWS Glue Data Catalog table dataset in Federated Search.

Authentication and Authorization
Usage of the POST operation for this endpoint is restricted to roles that have the admin_all_objects capability.

POST

Expand

Turns a specific federated index on.

Last modified on 07 March, 2025
Access endpoint descriptions   Knowledge endpoint descriptions

This documentation applies to the following versions of Splunk Cloud Platform™: 9.1.2312, 9.2.2403

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters