REST API

noun

Splunk's API is RESTful, meaning that every communication with the API uses HTTP requests to interact with resources within Splunk. There are two main tasks you can do with Splunk's API: run searches and manage Splunk configurations and objects. The REST API is divided into endpoints, or URIs served off of splunkd. All management endpoints behave the same, meaning they take the same global parameters and return responses in the same format. The search endpoints are special cases and behave differently from the configuration endpoints.

Since Splunk's API is REST, it supports GET and POST. The management endpoints also support PUT and DELETE. Use a GET request to retrieve information from a resource and a POST update a resource. DELETE removes an entire resource while PUT updates an entire resource. After receiving your request, Splunk's API sends back an HTTP code an a response in XML (unless otherwise specified).

For more information

In the REST API Reference:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time