Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Configurations

Use the Configuration endpoints to access and modify Splunk configuration files and settings.

An understanding of how Splunk uses configuration files helps understand how to use these endpoints. Refer to About Configuration Files and Configuration File Precedence in the Splunk Admin manual.

The topic Accessing and updating Splunk configurations in this manual describes the differences between the configs/conf-{file}/ and properties/ endpoints.


configs/conf-{file}

Provides raw access to Splunk's ".conf" configuration files.

Refer to Accessing and updating Splunk configurations for a comparison of these endpoints with the properties/ endpoints.

GET configs/conf-{file}

Lists all stanzas contained in the named configuration file.

Request

Name Type Required Default Description
count Number 30 Maximum number of items to return.
offset Number 0 Index for first item to return.
search String Boolean predicate to filter results.
sort_dir String name Direction to sort by (asc/desc).
sort_key String name Field to sort by.
sort_mode String name Collating sequence for the sort (auto, alpha, alpha_case, num).

Response Codes

Status Code Description
200 Listed successfully.
401 Authentication failure: must pass valid credentials with request.
403 Insufficient permissions to view configuration file.
500 Internal server error. See response body for details.

Returned Values

No values returned for this request.

Example

Displays the stanzas existing in props.conf.


curl -k -u admin:pass https://localhost:8089/services/configs/conf-props


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>conf-props</title>
  <id>https://localhost:8089/services/configs/conf-props</id>
  <updated>2011-07-08T01:01:26-07:00</updated>
  <generator version="102807"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/configs/conf-props/_new" rel="create"/>
  <link href="/services/configs/conf-props/_reload" rel="_reload"/>
  <!-- opensearch nodes elided for brevity. -->
  <s:messages/>
  <entry>
    <title>(?i)source::....zip(.\d+)?</title>
    <id>https://localhost:8089/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F</id>
    <updated>2011-07-08T01:01:26-07:00</updated>
    <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="list"/>
    <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="edit"/>
    <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="ANNOTATE_PUNCT">1</s:key>
        <s:key name="BREAK_ONLY_BEFORE"/>
        <s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
        <s:key name="CHARSET">UTF-8</s:key>
        <s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
        <s:key name="HEADER_MODE"/>
        <s:key name="LEARN_SOURCETYPE">1</s:key>
        <s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
        <s:key name="MAX_DAYS_AGO">2000</s:key>
        <s:key name="MAX_DAYS_HENCE">2</s:key>
        <s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
        <s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
        <s:key name="MAX_EVENTS">256</s:key>
        <s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
        <s:key name="MUST_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_BEFORE"/>
        <s:key name="NO_BINARY_CHECK">1</s:key>
        <s:key name="SEGMENTATION">indexing</s:key>
        <s:key name="SEGMENTATION-all">full</s:key>
        <s:key name="SEGMENTATION-inner">inner</s:key>
        <s:key name="SEGMENTATION-outer">outer</s:key>
        <s:key name="SEGMENTATION-raw">none</s:key>
        <s:key name="SEGMENTATION-standard">standard</s:key>
        <s:key name="SHOULD_LINEMERGE">1</s:key>
        <s:key name="TRANSFORMS"/>
        <s:key name="TRUNCATE">10000</s:key>
        <s:key name="disabled">0</s:key>
        <!-- eai:acl nodes elided for brevity. -->
        <s:key name="eai:appName">search</s:key>
        <s:key name="eai:userName">admin</s:key>
        <s:key name="maxDist">100</s:key>
        <s:key name="sourcetype">preprocess-zip</s:key>
        <s:key name="unarchive_cmd">_auto</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

POST configs/conf-{file}

Allows for creating the stanza specified by "name" in the configuration file specified by {file}.

Request

Name Type Required Default Description
name String
The name of the stanza to create.
<key> String This operation accepts an arbitrary set of key/value pairs to populate in the created stanza. (There is no actual parameter named "key".)

Response Codes

Status Code Description
201 Created successfully.
401 Authentication failure: must pass valid credentials with request.
403 Insufficient permissions to create configuration stanza.
500 Internal server error. See response body for details.

Returned Values

No values returned for this request.

Example

Configures the sourcetype "myweblogs" in props.conf to use the UTF-8 character set and disable line-merging.


curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props \
	-d name=myweblogs \
	-d CHARSET=UTF-8 \
	-d SHOULD_LINEMERGE=false


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>conf-props</title>
  <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
  <updated>2011-07-08T01:01:26-07:00</updated>
  <generator version="102807"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
  <link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
  <!-- opensearch nodes elided for brevity. -->
  <s:messages/>
  <entry>
    <title>myweblogs</title>
    <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs</id>
    <updated>2011-07-08T01:01:26-07:00</updated>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="alternate"/>
    <author>
      <name>admin</name>
    </author>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="list"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="edit"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="remove"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/move" rel="move"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="ANNOTATE_PUNCT">1</s:key>
        <s:key name="BREAK_ONLY_BEFORE"/>
        <s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
        <s:key name="CHARSET">UTF-8</s:key>
        <s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
        <s:key name="HEADER_MODE"/>
        <s:key name="LEARN_SOURCETYPE">1</s:key>
        <s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
        <s:key name="MAX_DAYS_AGO">2000</s:key>
        <s:key name="MAX_DAYS_HENCE">2</s:key>
        <s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
        <s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
        <s:key name="MAX_EVENTS">256</s:key>
        <s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
        <s:key name="MUST_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_BEFORE"/>
        <s:key name="SEGMENTATION">indexing</s:key>
        <s:key name="SEGMENTATION-all">full</s:key>
        <s:key name="SEGMENTATION-inner">inner</s:key>
        <s:key name="SEGMENTATION-outer">outer</s:key>
        <s:key name="SEGMENTATION-raw">none</s:key>
        <s:key name="SEGMENTATION-standard">standard</s:key>
        <s:key name="SHOULD_LINEMERGE">0</s:key>
        <s:key name="TRANSFORMS"/>
        <s:key name="TRUNCATE">10000</s:key>
        <s:key name="disabled">0</s:key>
        <!-- eai:acl nodes elided for brevity. -->
        <s:key name="eai:appName">search</s:key>
        <s:key name="eai:userName">admin</s:key>
        <s:key name="maxDist">100</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

configs/conf-{file}/{name}

DELETE configs/conf-{file}/{name}

Deletes the named stanza in the named configuration file.

Request

No parameters for this request.

Response Codes

Status Code Description
200 Deleted successfully.
401 Authentication failure: must pass valid credentials with request.
403 Insufficient permissions to delete configuration stanza.
500 Internal server error. See response body for details.

Returned Values

No values returned for this request.

Example

Deletes the configuration stanza for sourcetype "myweblogs" in props.conf.


curl -k -u admin:pass --request DELETE \
	https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>conf-props</title>
  <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
  <updated>2011-07-08T01:01:27-07:00</updated>
  <generator version="102807"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
  <link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
  <!-- opensearch nodes elided for brevity. -->
  <s:messages/>
</feed>

GET configs/conf-{file}/{name}

Display only the named stanza from the named configuration file.

Request

No parameters for this request.

Response Codes

Status Code Description
200 Listed successfully.
401 Authentication failure: must pass valid credentials with request.
403 Insufficient permissions to view configuration stanza.
500 Internal server error. See response body for details.

Returned Values

No values returned for this request.

Example

Displays only the configuration for the "myweblogs" sourcetype in props.conf.


curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>conf-props</title>
  <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
  <updated>2011-07-08T01:01:26-07:00</updated>
  <generator version="102807"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
  <link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
  <!-- opensearch nodes elided for brevity. -->
  <s:messages/>
  <entry>
    <title>myweblogs</title>
    <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs</id>
    <updated>2011-07-08T01:01:26-07:00</updated>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="alternate"/>
    <author>
      <name>admin</name>
    </author>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="list"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="edit"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="remove"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/move" rel="move"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="ANNOTATE_PUNCT">1</s:key>
        <s:key name="BREAK_ONLY_BEFORE"/>
        <s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
        <s:key name="CHARSET">UTF-8</s:key>
        <s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
        <s:key name="HEADER_MODE"/>
        <s:key name="LEARN_SOURCETYPE">1</s:key>
        <s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
        <s:key name="MAX_DAYS_AGO">2000</s:key>
        <s:key name="MAX_DAYS_HENCE">2</s:key>
        <s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
        <s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
        <s:key name="MAX_EVENTS">256</s:key>
        <s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
        <s:key name="MUST_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_BEFORE"/>
        <s:key name="SEGMENTATION">indexing</s:key>
        <s:key name="SEGMENTATION-all">full</s:key>
        <s:key name="SEGMENTATION-inner">inner</s:key>
        <s:key name="SEGMENTATION-outer">outer</s:key>
        <s:key name="SEGMENTATION-raw">none</s:key>
        <s:key name="SEGMENTATION-standard">standard</s:key>
        <s:key name="SHOULD_LINEMERGE">0</s:key>
        <s:key name="TRANSFORMS"/>
        <s:key name="TRUNCATE">10000</s:key>
        <s:key name="disabled">0</s:key>
        <!-- eai:acl nodes elided for brevity. -->
        <s:key name="eai:appName">search</s:key>
        <s:key name="eai:attributes">
          <s:dict>
            <s:key name="optionalFields">
              <s:list/>
            </s:key>
            <s:key name="requiredFields">
              <s:list/>
            </s:key>
            <s:key name="wildcardFields">
              <s:list>
                <s:item>.*</s:item>
              </s:list>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="eai:userName">admin</s:key>
        <s:key name="maxDist">100</s:key>
      </s:dict>
    </content>
  </entry>
</feed>

POST configs/conf-{file}/{name}

Allows for editing the named stanza from the named configuration file.

Request

Name Type Required Default Description
<key> String This operation accepts an arbitrary set of key/value pairs to populate in the created stanza. (There is no actual parameter named "key".)

Response Codes

Status Code Description
200 Updated successfully.
401 Authentication failure: must pass valid credentials with request.
403 Insufficient permissions to edit configuration stanza.
500 Internal server error. See response body for details.

Returned Values

No values returned for this request.

Example

Enables line-merging for the "myweblogs" sourcetype existing in props.conf.


curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs \
	-d SHOULD_LINEMERGE=true


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>conf-props</title>
  <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id>
  <updated>2011-07-08T01:01:26-07:00</updated>
  <generator version="102807"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/>
  <link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/>
  <!-- opensearch nodes elided for brevity. -->
  <s:messages/>
  <entry>
    <title>myweblogs</title>
    <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs</id>
    <updated>2011-07-08T01:01:26-07:00</updated>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="alternate"/>
    <author>
      <name>admin</name>
    </author>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="list"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="edit"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="remove"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/move" rel="move"/>
    <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="ANNOTATE_PUNCT">1</s:key>
        <s:key name="BREAK_ONLY_BEFORE"/>
        <s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key>
        <s:key name="CHARSET">UTF-8</s:key>
        <s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key>
        <s:key name="HEADER_MODE"/>
        <s:key name="LEARN_SOURCETYPE">1</s:key>
        <s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key>
        <s:key name="MAX_DAYS_AGO">2000</s:key>
        <s:key name="MAX_DAYS_HENCE">2</s:key>
        <s:key name="MAX_DIFF_SECS_AGO">3600</s:key>
        <s:key name="MAX_DIFF_SECS_HENCE">604800</s:key>
        <s:key name="MAX_EVENTS">256</s:key>
        <s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key>
        <s:key name="MUST_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_AFTER"/>
        <s:key name="MUST_NOT_BREAK_BEFORE"/>
        <s:key name="SEGMENTATION">indexing</s:key>
        <s:key name="SEGMENTATION-all">full</s:key>
        <s:key name="SEGMENTATION-inner">inner</s:key>
        <s:key name="SEGMENTATION-outer">outer</s:key>
        <s:key name="SEGMENTATION-raw">none</s:key>
        <s:key name="SEGMENTATION-standard">standard</s:key>
        <s:key name="SHOULD_LINEMERGE">1</s:key>
        <s:key name="TRANSFORMS"/>
        <s:key name="TRUNCATE">10000</s:key>
        <s:key name="disabled">0</s:key>
        <!-- eai:acl nodes elided for brevity. -->
        <s:key name="eai:appName">search</s:key>
        <s:key name="eai:userName">admin</s:key>
        <s:key name="maxDist">100</s:key>
      </s:dict>
    </content>
  </entry>
</feed>


properties

Provides access to configuration files.

Refer to Accessing and updating Splunk configurations for a comparison of these endpoints with the configs/conf-{file} endpoints.

Note: The DELETE operation from the properties endpoint is deprecated and will be removed from future releases. Instead, use the DELETE operation from the configs/conf-{file}/{name} endpoint.

GET properties

Returns a list of configurations that are saved in configuration files.

Request

No parameters for this request.

Response Codes

Status Code Description
200 Listed successfully.

Returned Values

No values returned for this request.

Example

Lists the names of all configuration files known to the Splunk instance.


curl -k -u admin:pass https://localhost:8089/services/properties


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>properties</title>
  <id>https://localhost:8089/services/properties</id>
  <updated>2011-07-08T11:33:18-07:00</updated>
  <generator version="102807"/>
  <author>
    <name>Splunk</name>
  </author>
  <entry>
    <title>alert_actions</title>
    <id>https://localhost:8089/services/properties/alert_actions</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/alert_actions" rel="alternate"/>
  </entry>
  <entry>
    <title>app</title>
    <id>https://localhost:8089/services/properties/app</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/app" rel="alternate"/>
  </entry>
  <entry>
    <title>audit</title>
    <id>https://localhost:8089/services/properties/audit</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/audit" rel="alternate"/>
  </entry>
  <entry>
    <title>authentication</title>
    <id>https://localhost:8089/services/properties/authentication</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/authentication" rel="alternate"/>
  </entry>
  <entry>
    <title>authorize</title>
    <id>https://localhost:8089/services/properties/authorize</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/authorize" rel="alternate"/>
  </entry>
  <entry>
    <title>commands</title>
    <id>https://localhost:8089/services/properties/commands</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/commands" rel="alternate"/>
  </entry>
  <entry>
    <title>conf</title>
    <id>https://localhost:8089/services/properties/conf</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/conf" rel="alternate"/>
  </entry>
  <entry>
    <title>crawl</title>
    <id>https://localhost:8089/services/properties/crawl</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/crawl" rel="alternate"/>
  </entry>
  <entry>
    <title>datatypesbnf</title>
    <id>https://localhost:8089/services/properties/datatypesbnf</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/datatypesbnf" rel="alternate"/>
  </entry>
  <entry>
    <title>default-mode</title>
    <id>https://localhost:8089/services/properties/default-mode</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/default-mode" rel="alternate"/>
  </entry>
  <entry>
    <title>deploymentclient</title>
    <id>https://localhost:8089/services/properties/deploymentclient</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/deploymentclient" rel="alternate"/>
  </entry>
  <entry>
    <title>distsearch</title>
    <id>https://localhost:8089/services/properties/distsearch</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/distsearch" rel="alternate"/>
  </entry>
  <entry>
    <title>event_renderers</title>
    <id>https://localhost:8089/services/properties/event_renderers</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/event_renderers" rel="alternate"/>
  </entry>
  <entry>
    <title>eventdiscoverer</title>
    <id>https://localhost:8089/services/properties/eventdiscoverer</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/eventdiscoverer" rel="alternate"/>
  </entry>
  <entry>
    <title>eventtypes</title>
    <id>https://localhost:8089/services/properties/eventtypes</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/eventtypes" rel="alternate"/>
  </entry>
  <entry>
    <title>fields</title>
    <id>https://localhost:8089/services/properties/fields</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/fields" rel="alternate"/>
  </entry>
  <entry>
    <title>indexes</title>
    <id>https://localhost:8089/services/properties/indexes</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/indexes" rel="alternate"/>
  </entry>
  <entry>
    <title>inputs</title>
    <id>https://localhost:8089/services/properties/inputs</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/inputs" rel="alternate"/>
  </entry>
  <entry>
    <title>launcher</title>
    <id>https://localhost:8089/services/properties/launcher</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/launcher" rel="alternate"/>
  </entry>
  <entry>
    <title>limits</title>
    <id>https://localhost:8089/services/properties/limits</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/limits" rel="alternate"/>
  </entry>
  <entry>
    <title>literals</title>
    <id>https://localhost:8089/services/properties/literals</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/literals" rel="alternate"/>
  </entry>
  <entry>
    <title>lookups</title>
    <id>https://localhost:8089/services/properties/lookups</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/lookups" rel="alternate"/>
  </entry>
  <entry>
    <title>macros</title>
    <id>https://localhost:8089/services/properties/macros</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/macros" rel="alternate"/>
  </entry>
  <entry>
    <title>manager</title>
    <id>https://localhost:8089/services/properties/manager</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/manager" rel="alternate"/>
  </entry>
  <entry>
    <title>nav</title>
    <id>https://localhost:8089/services/properties/nav</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/nav" rel="alternate"/>
  </entry>
  <entry>
    <title>outputs</title>
    <id>https://localhost:8089/services/properties/outputs</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/outputs" rel="alternate"/>
  </entry>
  <entry>
    <title>pdf_server</title>
    <id>https://localhost:8089/services/properties/pdf_server</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/pdf_server" rel="alternate"/>
  </entry>
  <entry>
    <title>prefs</title>
    <id>https://localhost:8089/services/properties/prefs</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/prefs" rel="alternate"/>
  </entry>
  <entry>
    <title>props</title>
    <id>https://localhost:8089/services/properties/props</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/props" rel="alternate"/>
  </entry>
  <entry>
    <title>quickstart</title>
    <id>https://localhost:8089/services/properties/quickstart</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/quickstart" rel="alternate"/>
  </entry>
  <entry>
    <title>restmap</title>
    <id>https://localhost:8089/services/properties/restmap</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/restmap" rel="alternate"/>
  </entry>
  <entry>
    <title>savedsearches</title>
    <id>https://localhost:8089/services/properties/savedsearches</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/savedsearches" rel="alternate"/>
  </entry>
  <entry>
    <title>searchbnf</title>
    <id>https://localhost:8089/services/properties/searchbnf</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/searchbnf" rel="alternate"/>
  </entry>
  <entry>
    <title>searchscripts</title>
    <id>https://localhost:8089/services/properties/searchscripts</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/searchscripts" rel="alternate"/>
  </entry>
  <entry>
    <title>segmenters</title>
    <id>https://localhost:8089/services/properties/segmenters</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/segmenters" rel="alternate"/>
  </entry>
  <entry>
    <title>server</title>
    <id>https://localhost:8089/services/properties/server</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/server" rel="alternate"/>
  </entry>
  <entry>
    <title>serverclass</title>
    <id>https://localhost:8089/services/properties/serverclass</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/serverclass" rel="alternate"/>
  </entry>
  <entry>
    <title>source-classifier</title>
    <id>https://localhost:8089/services/properties/source-classifier</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/source-classifier" rel="alternate"/>
  </entry>
  <entry>
    <title>sourcetypes</title>
    <id>https://localhost:8089/services/properties/sourcetypes</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/sourcetypes" rel="alternate"/>
  </entry>
  <entry>
    <title>tenants</title>
    <id>https://localhost:8089/services/properties/tenants</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/tenants" rel="alternate"/>
  </entry>
  <entry>
    <title>times</title>
    <id>https://localhost:8089/services/properties/times</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/times" rel="alternate"/>
  </entry>
  <entry>
    <title>transactiontypes</title>
    <id>https://localhost:8089/services/properties/transactiontypes</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/transactiontypes" rel="alternate"/>
  </entry>
  <entry>
    <title>transforms</title>
    <id>https://localhost:8089/services/properties/transforms</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/transforms" rel="alternate"/>
  </entry>
  <entry>
    <title>user-prefs</title>
    <id>https://localhost:8089/services/properties/user-prefs</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/user-prefs" rel="alternate"/>
  </entry>
  <entry>
    <title>views</title>
    <id>https://localhost:8089/services/properties/views</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/views" rel="alternate"/>
  </entry>
  <entry>
    <title>viewstates</title>
    <id>https://localhost:8089/services/properties/viewstates</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/viewstates" rel="alternate"/>
  </entry>
  <entry>
    <title>web</title>
    <id>https://localhost:8089/services/properties/web</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/web" rel="alternate"/>
  </entry>
  <entry>
    <title>workflow_actions</title>
    <id>https://localhost:8089/services/properties/workflow_actions</id>
    <updated>2011-07-08T11:33:18-07:00</updated>
    <link href="/services/properties/workflow_actions" rel="alternate"/>
  </entry>
</feed>

POST properties

Creates a new configuration file.

Request

Name Type Required Default Description
__conf String
The name of the configuration file to create.

Note: Double underscore before conf.

Response Codes

Status Code Description
201 Created successfully.
400 Request error. See response body for details.

Returned Values

No values returned for this request.

Example

Creates a new configuration file named myapp.conf.


curl -k -u admin:pass https://localhost:8089/services/properties \
	-d __conf=myapp


Empty response.

properties/{file_name}

GET properties/{file_name}

Returns a list of stanzas in the configuration file specified by {name}.

Request

No parameters for this request.

Response Codes

Status Code Description
200 Listed successfully.
404 Named file does not exist.

Returned Values

No values returned for this request.

Example

Display configuration stanzas for the props.conf file.


curl -k -u admin:pass https://localhost:8089/services/properties/props


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>props</title>
  <id>https://localhost:8089/services/properties/props</id>
  <updated>2012-11-09T12:29:56-08:00</updated>
  <generator build="140868" version="5.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <entry>
    <title>(?i)source::....zip(.\d+)?</title>
    <id>https://localhost:8089/services/properties/props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="alternate"/>
  </entry>
  <entry>
    <title>ActiveDirectory</title>
    <id>https://localhost:8089/services/properties/props/ActiveDirectory</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/ActiveDirectory" rel="alternate"/>
  </entry>
  <entry>
    <title>PerformanceMonitor</title>
    <id>https://localhost:8089/services/properties/props/PerformanceMonitor</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/PerformanceMonitor" rel="alternate"/>
  </entry>
. . .
  <entry>
    <title>source::.../var/log/splunk/(license_usage).log(.\d+)?</title>
    <id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28license_usage%29.log%28.%5Cd%2B%29%3F</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28license_usage%29.log%28.%5Cd%2B%29%3F" rel="alternate"/>
  </entry>
  <entry>
    <title>source::.../var/log/splunk/(web|report)_access.log</title>
    <id>https://localhost:8089/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28web%7Creport%29_access.log</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/source%3A%3A...%2Fvar%2Flog%2Fsplunk%2F%28web%7Creport%29_access.log" rel="alternate"/>
  </entry>
. . .
  <entry>
    <title>splunk_directory_monitor</title>
    <id>https://localhost:8089/services/properties/props/splunk_directory_monitor</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/splunk_directory_monitor" rel="alternate"/>
  </entry>
  <entry>
    <title>splunk_directory_monitor_misc</title>
    <id>https://localhost:8089/services/properties/props/splunk_directory_monitor_misc</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/splunk_directory_monitor_misc" rel="alternate"/>
  </entry>
. . .
  <entry>
    <title>wtmp</title>
    <id>https://localhost:8089/services/properties/props/wtmp</id>
    <updated>2012-11-09T12:29:56-08:00</updated>
    <link href="/services/properties/props/wtmp" rel="alternate"/>
  </entry>
</feed>

POST properties/{file_name}

Creates a new stanza in the configuratin file specified by {name}.

Request

Name Type Required Default Description
__stanza String
The name of the stanza to create.

Note: Double underscore before stanza.

Response Codes

Status Code Description
201 Stanza created successfully.
303 Stanza already exists.
400 Request error. See response body for details.

Returned Values

No values returned for this request.

Example

Creates a stanza named proxylogs in props.conf.


curl -k -u admin:pass https://localhost:8089/services/properties/props \
	-d __stanza=proxylogs


No XML response.

properties/{file_name}/{stanza_name}

GET properties/{file_name}/{stanza_name}

Returns the configuration values for the stanza represented by {stanza_name} in the configuration file specified by {file_name}.

Request

No parameters for this request.

Response Codes

Status Code Description
200 Listed successfully.
404 Stanza does not exist.

Returned Values

No values returned for this request.

Example

Retrieves the stanza named proxylogs from props.conf.


curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs


<feed xmlns="http://www.w3.org/2005/Atom"
      xmlns:s="http://dev.splunk.com/ns/rest">
  <title>proxylogs</title>
  <id>https://localhost:8089/services/properties/props/proxylogs</id>
  <updated>2011-07-08T12:08:52-07:00</updated>
  <generator version="102807"/>
  <author>
    <name>Splunk</name>
  </author>
  <entry>
    <title>ANNOTATE_PUNCT</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/ANNOTATE_PUNCT</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/ANNOTATE_PUNCT" rel="alternate"/>
    <content type="text">True</content>
  </entry>
  <entry>
    <title>BREAK_ONLY_BEFORE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/BREAK_ONLY_BEFORE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/BREAK_ONLY_BEFORE" rel="alternate"/>
    <content type="text"/>
  </entry>
  <entry>
    <title>BREAK_ONLY_BEFORE_DATE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/BREAK_ONLY_BEFORE_DATE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/BREAK_ONLY_BEFORE_DATE" rel="alternate"/>
    <content type="text">True</content>
  </entry>
  <entry>
    <title>CHARSET</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/CHARSET</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/CHARSET" rel="alternate"/>
    <content type="text">UTF-8</content>
  </entry>
  <entry>
    <title>DATETIME_CONFIG</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/DATETIME_CONFIG</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/DATETIME_CONFIG" rel="alternate"/>
    <content type="text">/etc/datetime.xml</content>
  </entry>
  <entry>
    <title>HEADER_MODE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/HEADER_MODE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/HEADER_MODE" rel="alternate"/>
    <content type="text"/>
  </entry>
  <entry>
    <title>LEARN_SOURCETYPE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/LEARN_SOURCETYPE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/LEARN_SOURCETYPE" rel="alternate"/>
    <content type="text">true</content>
  </entry>
  <entry>
    <title>LINE_BREAKER_LOOKBEHIND</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/LINE_BREAKER_LOOKBEHIND</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/LINE_BREAKER_LOOKBEHIND" rel="alternate"/>
    <content type="text">100</content>
  </entry>
  <entry>
    <title>MAX_DAYS_AGO</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MAX_DAYS_AGO</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MAX_DAYS_AGO" rel="alternate"/>
    <content type="text">2000</content>
  </entry>
  <entry>
    <title>MAX_DAYS_HENCE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MAX_DAYS_HENCE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MAX_DAYS_HENCE" rel="alternate"/>
    <content type="text">2</content>
  </entry>
  <entry>
    <title>MAX_DIFF_SECS_AGO</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MAX_DIFF_SECS_AGO</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MAX_DIFF_SECS_AGO" rel="alternate"/>
    <content type="text">3600</content>
  </entry>
  <entry>
    <title>MAX_DIFF_SECS_HENCE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MAX_DIFF_SECS_HENCE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MAX_DIFF_SECS_HENCE" rel="alternate"/>
    <content type="text">604800</content>
  </entry>
  <entry>
    <title>MAX_EVENTS</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MAX_EVENTS</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MAX_EVENTS" rel="alternate"/>
    <content type="text">256</content>
  </entry>
  <entry>
    <title>MAX_TIMESTAMP_LOOKAHEAD</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MAX_TIMESTAMP_LOOKAHEAD</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MAX_TIMESTAMP_LOOKAHEAD" rel="alternate"/>
    <content type="text">128</content>
  </entry>
  <entry>
    <title>MUST_BREAK_AFTER</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MUST_BREAK_AFTER</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MUST_BREAK_AFTER" rel="alternate"/>
    <content type="text"/>
  </entry>
  <entry>
    <title>MUST_NOT_BREAK_AFTER</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MUST_NOT_BREAK_AFTER</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MUST_NOT_BREAK_AFTER" rel="alternate"/>
    <content type="text"/>
  </entry>
  <entry>
    <title>MUST_NOT_BREAK_BEFORE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/MUST_NOT_BREAK_BEFORE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/MUST_NOT_BREAK_BEFORE" rel="alternate"/>
    <content type="text"/>
  </entry>
  <entry>
    <title>SEGMENTATION</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/SEGMENTATION" rel="alternate"/>
    <content type="text">indexing</content>
  </entry>
  <entry>
    <title>SEGMENTATION-all</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-all</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/SEGMENTATION-all" rel="alternate"/>
    <content type="text">full</content>
  </entry>
  <entry>
    <title>SEGMENTATION-inner</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-inner</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/SEGMENTATION-inner" rel="alternate"/>
    <content type="text">inner</content>
  </entry>
  <entry>
    <title>SEGMENTATION-outer</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-outer</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/SEGMENTATION-outer" rel="alternate"/>
    <content type="text">outer</content>
  </entry>
  <entry>
    <title>SEGMENTATION-raw</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-raw</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/SEGMENTATION-raw" rel="alternate"/>
    <content type="text">none</content>
  </entry>
  <entry>
    <title>SEGMENTATION-standard</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/SEGMENTATION-standard</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/SEGMENTATION-standard" rel="alternate"/>
    <content type="text">standard</content>
  </entry>
  <entry>
    <title>SHOULD_LINEMERGE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/SHOULD_LINEMERGE" rel="alternate"/>
    <content type="text">True</content>
  </entry>
  <entry>
    <title>TRANSFORMS</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/TRANSFORMS</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/TRANSFORMS" rel="alternate"/>
    <content type="text"/>
  </entry>
  <entry>
    <title>TRUNCATE</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/TRUNCATE</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/TRUNCATE" rel="alternate"/>
    <content type="text">10000</content>
  </entry>
  <entry>
    <title>maxDist</title>
    <id>https://localhost:8089/services/properties/props/proxylogs/maxDist</id>
    <updated>2011-07-08T12:08:52-07:00</updated>
    <link href="/services/properties/props/proxylogs/maxDist" rel="alternate"/>
    <content type="text">100</content>
  </entry>
</feed>

POST properties/{file_name}/{stanza_name}

Adds or updates key/value pairs in the specified stanza. One or more key/value pairs may be passed at one time to this endpoint.

Request

Name Type Required Default Description
<key_name> String
Specifies a key/value pair to update.

Response Codes

Status Code Description
200 Updated successfully.
400 Request error. See response body for details.
404 Stanza does not exist.
409 Request error: this operation is invalid for this item. See returned XML for explanation.

Returned Values

No values returned for this request.

Example

Modifies two settings at once for the proxylogs sourcetype in props.conf.


curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs \
	-d NO_BINARY_CHECK=true \
	-d CHARSET=UTF-8


<response>
  <messages>
    <msg type="INFO">Successfully modified 2 key(s)</msg>
  </messages>
</response>

properties/{file_name}/{stanza_name}/{key_name}

GET properties/{file_name}/{stanza_name}/{key_name}

Returns the value of the key in plain text for specified stanza and configuration file.

Request

No parameters for this request.

Response Codes

Status Code Description
200 Listed successfully.
404 Key in the stanza does not exist.

Returned Values

No values returned for this request.

Example

Retreive the raw value (not XML) of the SHOULD_LINEMERGE setting from the proxylogs stanza in props.conf.


curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE


True

POST properties/{file_name}/{stanza_name}/{key_name}

Update an existing key value.

Request

Name Type Required Default Description
value String
The value to set for the named key in this named stanza in the named configuration file.

Response Codes

Status Code Description
200 Updated successfully.
400 Request error. See response body for details.
404 Key does not exist in the stanza.
409 Request error: this operation is invalid for this item. See returned XML for explanation.

Returned Values

No values returned for this request.

Example

Disables line merging for the proxylogs sourcetype in props.conf.


curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE \
	-d value=false


<response>
  <messages>
    <msg type="INFO">Successfully modified 1 key(s)</msg>
  </messages>
</response>
PREVIOUS
Clusters
  NEXT
Deployment

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters