Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

REST API Endpoints

REST API endpoint classification

Splunk resources are grouped according to the following categories:

Access control
Authorize and authenticate users.

Applications
Install applications and application templates into a Splunk instance.

Clusters
Configure and manage master and peer nodes in a cluster.

Configuration
Access and modify Splunk configuration files and settings.

Deployment
Manage deployment servers and clients.

Indexes
Create and manage data indexes.

Inputs
Manage data sent to Splunk servers.

Knowledge
Define data configurations indexed and searched by Splunk.

Licensing
Manage licensing configurations.

Outputs
Manage the configuration of data sent from Splunk forwarders.

Search
Manage searches, alerts, and view objects generated from searches.

System
Manage Splunk server configurations.

Alphabetical REST API endpoint list

alerts/

alerts/fired_alerts
    GET
alerts/fired_alerts/{name}
    GET   DELETE

apps/

apps/appinstall
    POST
apps/apptemplates
    GET
apps/apptemplates/{name}
    GET
apps/local
    GET   POST
apps/local/{name}
    GET   POST   DELETE
apps/local/{name}/package
    GET
apps/local/{name}/setup
    GET
apps/local/{name}/update
    GET

authentication/

auth/login
    POST
authentication/current-context
    GET
authentication/current-context/{name}
    GET
authentication/httpauth-tokens
    GET
authentication/httpauth-tokens/{name}
    GET   DELETE
LDAP-auth
authentication/users
    GET   POST
authentication/users/{name}
    GET   POST   DELETE

authorization/

authorization/capabilities
    GET
authorization/capabilities/{name}
    GET
authorization/roles
    GET   POST
authorization/roles/{name}
    GET   POST   DELETE

cluster/

cluster/config
    GET
cluster/config/{name}
    GET   POST
cluster/master/buckets
    GET
cluster/master/buckets/{name}
    GET
cluster/master/generation
    GET   POST
cluster/master/generation/{name}
    GET   POST
cluster/master/control/control/rebalance_primaries
    POST
cluster/master/info
    GET
cluster/master/info/{name}
    GET
cluster/master/peers
    GET
cluster/master/peers/{name}
    GET
cluster/searchhead/generation
    GET
cluster/searchhead/generation/{name}
    GET
cluster/searchhead/searchheadconfig
    GET   POST
cluster/searchhead/searchheadconfig/{name}
    GET   POST   DELETE
cluster/slave/buckets
    GET
cluster/slave/buckets/{name}
    GET   DELETE
cluster/slave/info
    GET
cluster/slave/info/{name}
    GET

configs/

configs/conf-{file}
    GET   POST
configs/conf-{file}/{name}
    GET   POST   DELETE

data/

data/commands
    GET
data/commands/{name}
    GET
data/indexes
    GET   POST
data/indexes/{name}
    GET   POST   DELETE
data/inputs/ad
    GET   POST
data/inputs/ad/{name}
    GET   POST   DELETE
data/inputs/all
    GET
data/inputs/all/{name}
    GET
data/inputs/monitor
    GET   POST
data/inputs/monitor/{name}
    GET   POST   DELETE
data/inputs/monitor/{name}/members
    GET
data/inputs/oneshot
    GET   POST
data/inputs/oneshot/{name}
    GET
data/inputs/registry
    GET   POST
data/inputs/registry/{name}
    GET   POST   DELETE
data/inputs/script
    GET   POST
data/inputs/script/restart
    POST
data/inputs/script/{name}
    GET   POST   DELETE
data/inputs/tcp/cooked
    GET   POST
data/inputs/tcp/cooked/{name}
    GET   POST   DELETE
data/inputs/tcp/cooked/{name}/connections
    GET
data/inputs/tcp/raw
    GET   POST
data/inputs/tcp/raw/{name}
    GET   POST   DELETE
data/inputs/tcp/raw/{name}/connections
    GET
data/inputs/tcp/ssl
    GET
data/inputs/tcp/ssl/{name}
    GET   POST
data/inputs/udp
    GET   POST
data/inputs/udp/{name}
    GET   POST   DELETE
data/inputs/udp/{name}/connections
    GET
data/inputs/win-event-log-collections
    GET   POST
data/inputs/win-event-log-collections/{name}
    GET   POST   DELETE
data/inputs/win-perfmon
    GET   POST
data/inputs/win-perfmon/{name}
    GET   POST   DELETE
data/inputs/win-wmi-collections
    GET   POST
data/inputs/win-wmi-collections/{name}
    GET   POST   DELETE
data/lookup-table-files
    GET   POST
data/lookup-table-files/{name}
    GET   POST   DELETE
data/modular-inputs
    GET
data/modular-inputs/{name}
    GET
data/outputs/tcp/default
    GET   POST
data/outputs/tcp/default/{name}
    GET   POST   DELETE
data/outputs/tcp/group
    GET   POST
data/outputs/tcp/group/{name}
    GET   POST   DELETE
data/outputs/tcp/server
    GET   POST
data/outputs/tcp/server/{name}
    GET   POST   DELETE
data/outputs/tcp/server/{name}/allconnections
    GET
data/outputs/tcp/syslog
    GET   POST
data/outputs/tcp/syslog/{name}
    GET   POST   DELETE
data/props/calcfields
    GET   POST
data/props/calcfields/{name}
    GET   POST   DELETE
data/props/extractions
    GET   POST
data/props/extractions/{name}
    GET   POST   DELETE
data/props/fieldaliases
    GET   POST
data/props/fieldaliases/{name}
    GET   POST   DELETE
data/props/lookups
    GET   POST
data/props/lookups/{name}
    GET   POST   DELETE
data/props/sourcetype-rename
    GET   POST
data/props/sourcetype-rename/{name}
    GET   POST   DELETE
data/transforms/extractions
    GET   POST
data/transforms/extractions/{name}
    GET   POST   DELETE
data/transforms/lookups
    GET   POST
data/transforms/lookups/{name}
    GET   POST   DELETE

datamodel/

datamodel/acceleration
    GET
datamodel/acceleration/{name}
    GET
datamodel/model
    GET   POST
datamodel/model/{name}
    GET   POST   DELETE
datamodel/pivot
    GET
datamodel/pivot/{name}
    GET

deployment/

deployment/client
    GET
deployment/client/config
    GET
deployment/client/config/listIsDisabled
    GET
deployment/client/config/reload
    POST
deployment/client/{name}/reload
    POST
deployment/server/applications
    GET
deployment/server/applications/{name}
    GET   POST
deployment/server/clients
    GET
deployment/server/clients/countClients_by_machineType
    GET
deployment/server/clients/countRecentDownloads
    GET
deployment/server/clients/{name}
    GET   DELETE
deployment/server/config
    GET
deployment/server/config/attributesUnsupportedInUI
    GET
deployment/server/config/listIsDisabled
    GET
deployment/server/config/{name}
    GET   POST
deployment/server/serverclasses
    GET   POST
deployment/server/serverclasses/rename
    POST
deployment/server/serverclasses/{name}
    GET   POST   DELETE

directory/

directory
    GET
directory/{name}
    GET

indexing/

indexing/preview
    GET   POST
indexing/preview/{job_id}
    GET

licenser/

licenser/groups
    GET
licenser/groups/{name}
    GET   POST
licenser/licenses
    GET   POST
licenser/licenses/{name}
    GET   DELETE
licenser/messages
    GET
licenser/messages/{name}
    GET
licenser/pools
    GET   POST
licenser/pools/{name}
    GET   POST   DELETE
licenser/slaves
    GET
licenser/slaves/{name}
    GET
licenser/stacks
    GET
licenser/stacks/{name}
    GET

messages/

messages
    GET   POST
messages/{name}
    GET   DELETE

properties/

properties
    GET   POST
properties/{file_name}
    GET   POST
properties/{file_name}/{stanza_name}
    GET   POST
properties/{file_name}/{stanza_name}/{key_name}
    GET   POST

receivers/

receivers/simple
    POST
receivers/stream
    POST

saved/

saved/eventtypes
    GET   POST
saved/eventtypes/{name}
    GET   POST   DELETE
saved/searches
    GET   POST
saved/searches/{name}
    GET   POST   DELETE
saved/searches/{name}/acknowledge
    POST
saved/searches/{name}/dispatch
    POST
saved/searches/{name}/history
    GET
saved/searches/{name}/reschedule
    POST
saved/searches/{name}/scheduled_times
    GET
saved/searches/{name}/suppress
    GET

scheduled/

scheduled/views
    GET
scheduled/views/{name}
    GET   POST   DELETE
scheduled/views/{name}/dispatch
    POST
scheduled/views/{name}/history
    GET
scheduled/views/{name}/reschedule
    POST
scheduled/views/{name}/scheduled_times
    GET

search/

search/distributed/bundle-replication-files
    GET
search/distributed/bundle-replication-files/{name}
    GET
search/distributed/config
    GET
search/distributed/config/{name}
    GET   POST   DELETE
search/distributed/peers
    GET   POST
search/distributed/peers/{name}
    GET   POST   DELETE
search/fields
    GET
search/fields/{field_name}
    GET
search/fields/{field_name}/tags
    GET   POST
search/jobs
    GET   POST
search/jobs/export
    GET
search/jobs/{search_id}
    GET   POST   DELETE
search/jobs/{search_id}/control
    POST
search/jobs/{search_id}/events
    GET
search/jobs/{search_id}/results
    GET
search/jobs/{search_id}/results_preview
    GET
search/jobs/{search_id}/search.log
    GET
search/jobs/{search_id}/summary
    GET
search/jobs/{search_id}/timeline
    GET
search/parser
    GET
search/tags
    GET
search/tags/{tag_name}
    GET   POST   DELETE
search/timeparser
    GET
search/typeahead
    GET

server/

server/control
    GET
server/control/restart
    POST
server/info
    GET
server/info/{name}
    GET
server/logger
    GET
server/logger/{name}
    GET   POST
server/settings
    GET
server/settings/{name}
    GET   POST

storage/

storage/passwords
    GET   POST
storage/passwords/{name}
    GET   POST   DELETE
PREVIOUS
Introduction
  NEXT
Access control

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters