Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

URI quick reference

alerts/ URI Summary Class GET POST DELETE
alerts/fired_alerts Access all fired alerts. Search X
alerts/fired_alerts/{name} Access specific fired alert. Search X X
apps/ URI Summary Class GET POST DELETE
apps/appinstall Install app from URL or local file. Applications X
apps/apptemplates Manage app templates. Applications X
apps/apptemplates/{name} Access particular app template. Applications X
apps/local Manage local apps. Applications X X
apps/local/{name} Manage specific local app. Applications X X X
apps/local/{name}/package Archive a specific app. Applications X
apps/local/{name}/setup Access app setup information. Applications X
apps/local/{name}/update Access update information for an app. Applications X
authentication/ URI Summary Class GET POST DELETE
auth/login Provide user authentication. Access control X
LDAP-auth Create and manage LDAP strategies Access control X X X
authentication/current-context Access current user contexts. Access control X
authentication/current-context/{name} Access specific user context. Access control X
authentication/httpauth-tokens Manage session tokens. Access control X
authentication/httpauth-tokens/{name} Manage specific session token. Access control X X
authentication/users Manage user accounts. Access control X X
authentication/users/{name} Manage specific user account. Access control X X X
authorization/ URI Summary Class GET POST DELETE
authorization/capabilities Access capability authorization. Access control X
authorization/capabilities/{name} Access specific capability. Access control X
authorization/roles Access user roles. Access control X X
authorization/roles/{name} Access specific user role. Access control X X X
cluster/ URI Summary Class GET POST DELETE
cluster/config Manage cluster configuration. Clusters X
cluster/config/{name} Manage specific cluster configuration. Clusters X X
cluster/master/buckets Access master node bucket configurations. Clusters X
cluster/master/buckets/{name} Access master node bucket info. Clusters X
cluster/master/control/control/rebalance_primaries Access master controls to rebalance primary buckets across peers. Clusters X
cluster/master/generation Access master node generation info. Clusters X X
cluster/master/generation/{name} Access specific generation information, cluster master. Clusters X X
cluster/master/indexes Access cluster index information. Clusters X
cluster/master/indexes/{name} Access specific cluster index information. Clusters X
cluster/master/info Access cluster master node information. Clusters X
cluster/master/peers Access peer information, master node. Clusters X
cluster/master/peers/{name} Access specific master node peer information. Clusters X
cluster/master/sites Access cluster site information. Clusters X
cluster/master/sites/{name} Access specific cluster site information. Clusters X
cluster/searchhead/generation Access searchhead peer information. Clusters X
cluster/searchhead/generation/{name} Access specific searchhead peer information. Clusters X
cluster/searchhead/searchheadconfig Access cluster configuration for searchhead. Clusters X X
cluster/searchhead/searchheadconfig/{name} Access specific cluster node. Clusters X X X
cluster/slave/buckets Access peer bucket configuration information. Clusters X
cluster/slave/buckets/{name} Access peer bucket configuration. Clusters X X
cluster/slave/info Access peer node information. Clusters X
cluster/slave/info/{name} Access information about specific peer. Clusters X
configs/ URI Summary Class GET POST DELETE
configs/conf-{file} Raw access to .conf files. Configuration X X
configs/conf-{file}/{name} Raw access to specific .conf file. Configuration X X X
data/ URI Summary Class GET POST DELETE
data/commands Access search commands. Search X
data/commands/{name} Access specific search command. Search X
data/index-volumes Access logical drive information. Indexes X
data/index-volumes/{name} Access logical drive information. Indexes X
data/indexes Manage data indexes. Indexes X X
data/indexes/{name} Manage specific data index. Indexes X X X
data/indexes-extended Access index bucket level information. Indexes X
data/indexes-extended/{name} access specific index bucket level info. Indexes X
data/inputs/ad Access Active Directory monitoring input. Inputs X X
data/inputs/ad/{name} Access Active Directory monitoring stanza. Inputs X X X
data/inputs/all Access all inputs, including Modular Inputs. Inputs X
data/inputs/all/{name} Access specific input. Inputs X
data/inputs/monitor Access monitor inputs. Inputs X X
data/inputs/monitor/{name} Manage specific monitor input. Inputs X X X
data/inputs/monitor/{name}/members Access files for the specific monitor input. Inputs X
data/inputs/oneshot Access one-shot inputs. Inputs X X
data/inputs/oneshot/{name} Access specific one-shot input information. Inputs X
data/inputs/registry Access Windows registry monitor input. Inputs X X
data/inputs/registry/{name} Manage Windows registry monitor stanza. Inputs X X X
data/inputs/script Manage scripted inputs settings. Inputs X X
data/inputs/script/restart Restart scripted input. Inputs X
data/inputs/script/{name} Manage specific scripted input. Inputs X X X
data/inputs/tcp/cooked Access forwarder TCP inputs. Inputs X X
data/inputs/tcp/cooked/{name} Manage TCP inputs for specific host:port. Inputs X X X
data/inputs/tcp/cooked/{name}/connections Access connections for specific port. Inputs X
data/inputs/tcp/raw Manage raw forwarder TCP inputs. Inputs X X
data/inputs/tcp/raw/{name} Access raw TCP input information. Inputs X X X
data/inputs/tcp/raw/{name}/connections Manage raw TCP input information for specific host:port. Inputs X
data/inputs/tcp/ssl Access SSL configuration information. Inputs X
data/inputs/tcp/ssl/{name} Access SSL configuration for specific host. Inputs X X
data/inputs/udp Access UDP inputs. Inputs X X
data/inputs/udp/{name} Manage specific UDP input. Inputs X X X
data/inputs/udp/{name}/connections Manage specific UDP input connection. Inputs X
data/inputs/win-event-log-collections Access configured event log collections. Inputs X X
data/inputs/win-event-log-collections/{name} Manage specific event log. Inputs X X X
data/inputs/win-perfmon Manage Windows perfmon. Inputs X X
data/inputs/win-perfmon/{name} Manage Windows perfmon config stanza. Inputs X X X
data/inputs/win-wmi-collections Access configured WMI collections. Inputs X X
data/inputs/win-wmi-collections/{name} Manage specific WMI collection. Inputs X X X
data/lookup-table-files Access lookup table files. Knowledge X X
data/lookup-table-files/{name} Manage specific lookup table file. Knowledge X X X
data/modular-inputs Access defined modular inputs. Inputs X
data/modular-inputs/{name} Manage specific modular input. Inputs X
data/outputs/tcp/default Access global TCP output properties. Outputs X X
data/outputs/tcp/default/{name} Manage TCP output property setting. Outputs X X X
data/outputs/tcp/group Manage data forwarding group config. Outputs X X
data/outputs/tcp/group/{name} Manage specific data forwarding group. Outputs X X X
data/outputs/tcp/server Access data forwarding configurations. Outputs X X
data/outputs/tcp/server/{name} Manage specific forwarder configuration. Outputs X X X
data/outputs/tcp/server/{name}/allconnections Access forwarder connections. Outputs X
data/outputs/tcp/syslog Access forwarded server configured to provide data in standard syslog format. Outputs X X
data/outputs/tcp/syslog/{name} Manage specific forwarder, which sends data in syslog format. Outputs X X X
data/props/calcfields Access props.conf file calculated fields. Knowledge X X
data/props/calcfields/{name} Manage specific props.conf file calculated field. Knowledge X X X
data/props/extractions Access props.conf file search-time field extractions. Knowledge X X
data/props/extractions/{name} Manage specific props.conf file field extraction. Knowledge X X X
data/props/fieldaliases Access props.conf file field aliases. Knowledge X X
data/props/fieldaliases/{name} Manage props.conf file field alias. Knowledge X X X
data/props/lookups Access props.conf file lookups. Knowledge X X
data/props/lookups/{name} Manage specific props.conf file automatic lookup. Knowledge X X X
data/props/sourcetype-rename Access renamed sourcetypes configured in props.conf file. Knowledge X X
data/props/sourcetype-rename/{name} Manage specific props.conf file sourcetype name. Knowledge X X X
data/transforms/extractions Access field extraction definitions. Knowledge X X
data/transforms/extractions/{name} Manage specific field extraction definition . Knowledge X X X
data/transforms/lookups Access transforms.conf file lookup definitions. Knowledge X X
data/transforms/lookups/{name} Manage specific transforms.conf file lookup definition. Knowledge X X X
datamodel/ URI Summary Class GET POST DELETE
datamodel/model Manage information about data models. Knowledge X X
datamodel/model/{name} Manage information about a data model. Knowledge X X X
datamodel/acceleration [Deprecated] Access information about data models that have acceleration enabled. Knowledge X
datamodel/acceleration/{name} [Deprecated] Access information about specific data model that has acceleration enabled. Knowledge X
datamodel/pivot Access pivots for named data models. Knowledge X
deployment/ URI Summary Class GET POST DELETE
deployment/client Access deployment client information . Deployment X
deployment/client/config Access deployment client configuration. Deployment X
deployment/client/config/listIsDisabled Access deployment client state. Deployment X
deployment/client/config/reload Access deployment client reload info. Deployment X
deployment/client/{name}/reload Manage specific deployment client reload. Deployment X
deployment/server/applications Access deployment server application and class information. Deployment X
deployment/server/applications/{name} Manage specific server client application and class information. Deployment X X
deployment/server/clients Access deployment server client info. Deployment X
deployment/server/clients/countClients_by_machineType Access deployment server client information by machine type. Deployment X
deployment/server/clients/countRecentDownloads Access client download information. Deployment X
deployment/server/clients/{name} Manage specific client. Deployment X X
deployment/server/config Access deployment server configuration. Deployment X
deployment/server/config/attributesUnsupportedInUI Access deployment server attributes not available using Splunk Web. Deployment X
deployment/server/config/listIsDisabled Access deployment server state. Deployment X
deployment/server/serverclasses Access server class information. Deployment X X
deployment/server/serverclasses/{name} Manage specific server class of deployment server. Deployment X X X
deployment/server/serverclasses/rename Manage server class name. Deployment X
directory/ URI Summary Class GET POST DELETE
directory Access user-configurable entities. Knowledge X
directory/{name} Access directory service entity. Knowledge X
indexing/ URI Summary Class GET POST DELETE
indexing/preview Preview events from a file before indexing. Inputs X X
indexing/preview/{job_id} Access props.conf file settings for specific data preview job. Inputs X
licenser/ URI Summary Class GET POST DELETE
licenser/groups Access licenser groups configuration. Licensing X
licenser/groups/{name} Manage a licenser group configuration. Licensing X X
licenser/licenses Access licenses. Licensing X X
licenser/licenses/{name} Manage specific license. Licensing X X
licenser/messages Access licenser messages. Licensing X
licenser/messages/{name} Access specific licenser message. Licensing X
licenser/pools Access licenser pool information. Licensing X X
licenser/pools/{name} Manage specific licenser pool. Licensing X X X
licenser/slaves Access license master slaves. Licensing X
licenser/slaves/{name} Access specific license master slave. Licensing X
licenser/stacks Access license stack configuration. Licensing X
licenser/stacks/{name} Access specific license stack configuration. Licensing X
messages/ URI Summary Class GET POST DELETE
messages Manage system messages. System X X
messages/{name} Manage specific system message. System X X
properties/ URI Summary Class GET POST DELETE
properties Access configuration files. Configuration X X
properties/{file_name} Manage a configuration file. Configuration X X
properties/{file_name}/{stanza_name} Manage a configuration file stanza. Configuration X X
properties/{file_name}/{stanza_name}/{key_name} Manage specific stanza in specific configuration file. Configuration X X
receivers/ URI Summary Class GET POST DELETE
receivers/simple Use HTTP to send events. Inputs X
receivers/stream Use socket to stream events. Inputs X
saved/ URI Summary Class GET POST DELETE
saved/eventtypes Manage saved event types. Knowledge X X
saved/eventtypes/{name} Manage specific saved event type. Knowledge X X X
saved/searches Manage saved searches configuration. Search X X
saved/searches/{name} Manage specific saved search. Search X X X
saved/searches/{name}/acknowledge Manage saved search alerting. Search X
saved/searches/{name}/dispatch Dispatch saved search. Search X
saved/searches/{name}/history Access saved search job history. Search X
saved/searches/{name}/reschedule Manage saved search job scheduling. Search X
saved/searches/{name}/scheduled_times Access saved search scheduled times. Search X
saved/searches/{name}/suppress Access saved search alerting state. Search X
scheduled/ URI Summary Class GET POST DELETE
scheduled/views Access scheduled views for PDF delivery. Search X
scheduled/views/{name} Manage specific scheduled view. Search X X X
scheduled/views/{name}/dispatch Dispatch search for specific scheduled view. Search X
scheduled/views/{name}/history Access specific scheduled view job history. Search X
scheduled/views/{name}/reschedule Manage scheduled view scheduling. Search X
scheduled/views/{name}/scheduled_times Access specific scheduled view times. Search X
search/ URI Summary Class GET POST DELETE
search/distributed/bundle-replication-files Access distributed search bundle replication files. Deployment X
search/distributed/bundle-replication-files/{name} Access a search bundle replication file. Deployment X
search/distributed/config Access distributed search options. Deployment X
search/distributed/peers Manage distributed server peers. Deployment X X
search/fields Access search field configuration. Knowledge X
search/fields/{field_name} Access specific search field configuration. Knowledge X
search/fields/{field_name}/tags Manage tags associated with a search field. Knowledge X X
search/jobs Manage search jobs. Search X X
search/jobs/{search_id} Manage specific search job. Search X X X
search/jobs/{search_id}/control Execute search job control command. Search X
search/jobs/{search_id}/events Access events for specific search. Search X
search/jobs/{search_id}/results Access results of specific search. Search X
search/jobs/{search_id}/results_preview Access preview results for specific search. Search X
search/jobs/{search_id}/search.log Access search.log file for a search. Search X
search/jobs/{search_id}/summary Access getFieldsAndStats output of so-far-read events. Search X
search/jobs/{search_id}/timeline Access event distribution over time. Search X
search/jobs/export Stream search results. Search X
search/parser Access search language parsing services. Search X
search/tags Access search time tags. Knowledge X
search/tags/{tag_name} Manage specific search time tag. Knowledge X X X
search/timeparser Parse time argument. Search X
search/typeahead Suggest search auto-completion strings. Search X
server/ URI Summary Class GET POST DELETE
server/control Access server controls. System X
server/control/restart Restart Splunk Enterprise server. System X
server/info Access server configuration. System X
server/logger Access logging categories. System X
server/logger/{name} Manage specific logging category. System X X
server/roles Access server role information. System X
server/settings Access server configuration. System X
server/status Access system status information. System X
server/status/dispatch-artifacts Access search job information. System X
server/status/fishbucket Access information about BTree database. System X
server/status/limits/search-concurrency Access search concurrency metrics. System X
server/status/partitions-space Access disk utilization information. System X
server/status/resource-usage Access resource utilization information. System X
server/status/resource-usage/hostwide Access host-level resource utilization info. System X
server/status/resource-usage/splunk-processes Access O/S resource utilization information. System X
storage/ URI Summary Class GET POST DELETE
storage/passwords Manage authentication credentials. Access control X X
storage/passwords/{name} Manage authentication credential. Access control X X X
Last modified on 09 December, 2016
Access control

This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters