Skip to main content
Splunk Cloud Platform

REST API Reference Manual

Splunk Cloud Platform™
9.2.2406 (latest FedRAMP release)

Metrics Catalog endpoint descriptions

Use the Metrics Catalog REST API to enumerate metrics and the dimensions and dimension values associated with metrics.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication are required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints, and must have the list_metrics_catalog capability to use the Metrics Catalog endpoint. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls > Users. To determine the capabilities assigned to a role, select Settings > Access controls > Roles.

App and user context

Typically, knowledge objects, such as saved searches or event types, have an app/user context that is the namespace. For more information about specifying a namespace, see Namespace in the REST API User Manual.

Default indexes for Metrics Catalog endpoints

If no metric indexes are defined with the filter parameter, Metrics Catalog endpoints use the default indexes specified for the role of the user. To review or update the default indexes for specific roles, select Settings > Access controls > Roles, select a role, and review or update the Indexes searched by default field.

If the set of default indexes for a role includes a mix of metrics indexes and event indexes, the Metrics Catalog endpoints only use the metrics indexes.

If there are no metrics indexes, the Metrics Catalog endpoints display an empty list.

Splunk Cloud Platform URL for REST API access

Splunk Cloud Platform has a different host and management port syntax than Splunk Enterprise. Use the following URL for Splunk Cloud Platform deployments. If necessary, submit a support case using the Splunk Support Portal to open port 8089 on your deployment.

https://<deployment-name>.splunkcloud.com:8089

Free trial Splunk Cloud Platform accounts cannot access the REST API.

See Access requirements and limitations for the Splunk Cloud Platform REST API in the the REST API Tutorials manual for more information.



catalog/metricstore/metrics

https://<host>:<mPort>/services/catalog/metricstore/metrics

Use this endpoint to list metric names.

GET

Expand

Returns metric names.


catalog/metricstore/dimensions

https://<host>:<mPort>/services/catalog/metricstore/dimensions

Use this endpoint to list dimension names.

GET

Expand

Returns dimension names for a given metric.


catalog/metricstore/dimensions/{dimension-name}/values

https://<host>:<mPort>/services/catalog/metricstore/dimensions/{dimension-name}/values

Use this endpoint to list values for a given {dimension-name}.

GET

Expand

Returns values of a {dimension-name} for a given metric.


catalog/metricstore/rollup

https://<host>:<mPort>/services/catalog/metricstore/rollup

Use this endpoint to retrieve lists of metric indexes and their rollup summaries and to create new rollup policies for a given metric index.

Authentication and authorization
Use of the GET operation for this endpoint is restricted to roles that have the list_metrics_catalog capability. Use of the POST operation for this endpoint is restricted to roles that have the edit_metrics_rollup capability.

GET

Expand

Returns rollup summaries and the metric indexes with which they are associated.

POST

Expand

Creates rollup policies for a specified metric index.



catalog/metricstore/rollup/{index}

https://<host>:<mPort>/services/catalog/metricstore/rollup/{index}

Use this endpoint to:

  • Retrieve a list of the rollup summaries associated with a specific source {index}.
  • Update a rollup policy for a specific specific source {index}.
  • Delete a rollup policy for a specific specific source {index}.

Authentication and Authorization
Use of the GET operation for this endpoint is restricted to roles that have the list_metrics_catalog capability. Usage of the POST and DELETE operations for this endpoint are restricted to roles that have the edit_metrics_rollup capability.

GET

Expand

Returns a list of the rollup summaries associated with a specific source {index}.

POST

Expand

Updates a rollup policy for a specific source {index}.

DELETE

Expand

Deletes a rollup policy for a specific source {index}.

Last modified on 19 January, 2023
KV store endpoint descriptions   Search endpoint descriptions

This documentation applies to the following versions of Splunk Cloud Platform: 9.3.2408, 8.2.2203, 9.0.2205, 8.2.2112, 8.2.2201, 8.2.2202, 9.0.2208, 9.0.2209, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release)


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters