Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Cluster endpoint descriptions

Manage master and peer cluster nodes.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

Splunk Cloud limitations

If you have a managed Splunk Cloud deployment with search head clustering and index clustering, the REST API supports access to the search head only. You can use the REST API to interact with the search head in your deployment. Using the REST API to access any other cluster member nodes is not supported. For example, index cluster management endpoints are not applicable to Splunk Cloud deployments.

Authorized users can access and configure other cluster members, including indexer, cluster master, and license master nodes, in the Splunk Cloud manager user interface. 


cluster/config

https://<host>:<mPort>/services/cluster/config

Description

Configure and access nodes in a cluster.

Method summary

Method Description Formats
GET List cluster node configuration. XML, JSON

GET cluster/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
cxn_timeout Low-level timeout, in seconds, for establishing connection between cluster nodes. Defaults to 60 seconds.
disabled Indicates if this node is disabled.
forwarderdata_rcv_port The port from which to receive data from a forwarder.
forwarderdata_use_ssl Indicates whether to use SSL when receiving data from a forwarder.
heartbeat_period Only valid for peer nodes in a cluster. The time, in seconds, that a peer attempts to send a heartbeat to the master
heartbeat_timeout Only valid for the master node in a cluster configuration. The time, in seconds, before a master considers a peer down. Once a peer is down, the master initiates steps to replicate buckets from the dead peer to its live peers. Defaults to 60 seconds.
master_uri Valid only for nodes configured as a peer or searchhead.

URI of the cluster master to which this node connects.

max_peer_build_load The number of jobs that a peer can have in progress at any time that make the bucket searchable.
max_peer_rep_load Maximum number of replications that can be ongoing as a target.
mode Valid values: (master | slave | searchhead | disabled) Defaults to disabled.

Sets operational mode for this cluster node. Only one master may exist per cluster.

ping_flag For internal use to facilitate communication between the master and peers.
quiet_period The time, in seconds, that a master waits for peers to add themselves to the cluster.
rcv_timeout Low-level timeout, in seconds, for receiving data between cluster nodes. Defaults to 60 seconds.
register_forwarder_address Not used.

Reserved for future use.

register_replication_address Valid only for nodes configured as peers. The address on which a peer is available for accepting replication data. This is useful in the cases where a peer host machine has multiple interfaces and only one of them can be reached by another splunkd instance.
register_search_address IP address that advertises this indexer to search heads.
rep_cxn_timeout Low-level timeout, in seconds, for establishing a connection for replicating data.
rep_max_rcv_timeout Maximum cumulative time, in seconds, for receiving acknowledgement data from peers. Defaults to 600s.
rep_max_send_timeout Maximum time, in seconds, for sending replication slice data between cluster nodes. Defaults to 600s.
rep_rcv_timeout Low-level timeout, in seconds, for receiving data between cluster nodes.
rep_send_timeout Low-level timeout, in seconds, for sending replication data between cluster nodes. Defaults to 5 seconds.
replication_factor Only valid for nodes configured as a master.

Determines how many copies of raw data are created in the cluster. This could be less than the number of cluster peers.

Must be greater than 0 and greater than or equal to the search factor. Defaults to 3.

replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
restart_timeout Only valid for nodes configured as a master. The amount of time, in seconds, the master waits for a peer to come back when the peer is restarted (to avoid the overhead of trying to fix the buckets that were on the peer). Defaults to 600 seconds.

Note: This only works if the peer is restarted from Splunk Web.

search_factor Only valid for nodes configured as a master. Determines how many searchable copies of each bucket to maintain. Must be less than or equal to replication_factor and greater than 0. Defaults to 2.
secret Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master.

Corresponds to pass4SymmKey setting in server.conf.

send_timeout Low-level timeout, in seconds, for sending data between cluster nodes. Defaults to 60 seconds.

[ Top ]


cluster/master/buckets

https://<host>:<mPort>/services/cluster/master/buckets

Description

Provides bucket configuration information for a cluster master node.


Method summary

Method Description Formats
GET Lists cluster master node bucket configuration. XML, JSON

GET cluster/master/buckets method detail

Example

Request parameters

Use one or more filters in the query string to select buckets or bucket states. For example, use this URL to filter buckets returned for both the main index and StreamingSource status.

https://localhost:8089/services/cluster/master/buckets?filter=index=main&filter=status=StreamingSource

See the following table for available filters.

Filter name Datatype Description
index String Index name.
status String Bucket state. Available options are
  • StreamingSource
  • StreamingTarget
  • Complete
  • StreamingError
  • PendingTruncate Bucket is scheduled to truncate.
  • PendingDiscard Bucket is scheduled to discard.
  • NonStreamingTarget
search_state String Bucket search state. Available options are
  • Searchable
  • Unsearchable
  • PendingSearchable Bucket scheduled to become searchable by transferring or building tsidx files.
  • PendingUnsearchable Bucket is scheduled to become unsearchable.
  • SearchablePendingMask Primary change is scheduled or in progress.
replication_count Number Use <, >, != or = with numbers to indicate filtering values.
search_count Number Use <, >, != or = with numbers to indicate filtering values.
bucket_size Number Use <, >, != or = with numbers to indicate filtering values.
frozen Boolean
1 | 0 or true | false
Return frozen buckets or non-frozen buckets.
has_primary Boolean
1 | 0 or true | false
Return buckets with primaries or without primaries.
meets_multisite_replication_count Boolean
1 | 0 or true | false
Return buckets that meet cluster replication policy or buckets that do not meet cluster replication policy.
meets_multisite_search_count Boolean
1 | 0 or true | false
Return buckets that meet cluster search policy or buckets that do not meet cluster search policy.
multisite_bucket Boolean
1 | 0 or true | false
Return buckets created in multisite mode or buckets not created in multisite mode.
origin_site String Site of the indexer where buckets were created.
standalone Boolean
1 | 0 or true | false
Use true or 1 to return standalone buckets. Use false or 0 to return clustered buckets.

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
bucket_size Indicates the size, in bytes, of the bucket.
constrain_to_origin_site Flag indicating this particular bucket is a clustered pre-multisite bucket. Such buckets are replicated only within their origin site.
force_roll Flag indicating hot bucket needs to be force to roll by master. Usually when hot bucket does not have enough streaming targets to meet the policy.
frozen Indicates if the bucket is frozen.
index Name of the index to which the bucket belongs.
origin_site Where the bucket originated.
peers Lists information about buckets on peers to this master.
primaries_by_site Primary peer (GIUD).
rep_count_by_site Number of buckets.
search_count_by_site Number of searchable buckets.
service_after_time Bucket service is deferred until after this time.
standalone Indicates if the bucket was created on the peer before the peer entered into a cluster configuration with this master.

[ Top ]


cluster/master/buckets/{name}

https://<host>:<mPort>/services/cluster/master/buckets/{name}

Description

Access bucket configuration information.

Method summary

Method Description Formats
GET List bucket configuration information. XML, JSON

GET cluster/master/buckets/{name} method detail

Example

Request parameters

The filter parameter of the Pagination and filtering parameters can be used with this method.


Response data keys
Name Description
bucket_size Indicates the size, in bytes, of the bucket.
constrain_to_origin_site Flag indicating this particular bucket is a clustered pre-multisite bucket. Such buckets are replicated only within their origin site.
force_roll Flag indicating hot bucket needs to be force to roll by master. Usually when hot bucket does not have enough streaming targets to meet the policy.
frozen Indicates if the bucket is frozen.
index Name of the index to which the bucket belongs.
origin_site Where the bucket originated.
peers Lists information about buckets on peers to this master.
primaries_by_site Primary peer (GIUD).
rep_count_by_site Number of buckets.
search_count_by_site Number of searchable buckets.
service_after_time Bucket service is deferred until after this time.
standalone Indicates if the bucket was created on the peer before the peer entered into a cluster configuration with this master.

[ Top ]


cluster/master/buckets/{bucket_id}/fix

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/fix

Description

Add the specified bucket to the fix list.

For more information, see "Bucket-fixing scenarios" in Managing Indexers and Clusters of Indexers.

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method Description Formats
POST Add this bucket to the fix list. XML, JSON

POST services/cluster/master/buckets/{bucket_id}/fix method detail

Example

Request parameters

None

Response data keys

None

[ Top ]


cluster/master/buckets/{bucket_id}/freeze

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/freeze

Description

Set the bucket state to frozen.

  • Note: Use this endpoint with caution. It is recommended to test the endpoint prior to use on an actual bucket.

For more information, see "How the cluster handles frozen buckets" in Managing Indexers and Clusters of Indexers.

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method Description Formats
POST Set this bucket state to frozen. XML, JSON

POST services/cluster/master/buckets/{bucket_id}/freeze method detail

Example

Request parameters

None

Response data keys

None

[ Top ]


cluster/master/buckets/{bucket_id}/remove_all

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/remove_all

Description

Delete all copies of the specified bucket.

  • Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test cluster prior to use on an actual bucket.

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method Description Formats
POST Delete all copies of the specified bucket. XML, JSON

POST services/cluster/master/buckets/{bucket_id}/remove_all method detail

Example

Request parameters

None

Response data keys

None. If an invalid bucket id is used, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': bucket not found</msg>
  </messages>
</response>

If the request is made on a hot bucket, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': cannot remove hot bucket from cluster</msg>
  </messages>
</response>

[ Top ]

cluster/master/buckets/{bucket_id}/remove_from_peer

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/remove_from_peer

Description

Deletes the copy of this bucket from specified peer.

If the request causes the cluster to lose its complete state, the cluster will engage in fixup activities. This may result in another copy of the same bucket appearing on this peer. If, however, the specified bucket is frozen, the cluster does not attempt any fixup activities.

  • Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test-cluster prior to use on an actual bucket.

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method Description Formats
POST Delete this bucket from specified peer. Set bucket state to frozen XML, JSON

POST services/cluster/master/buckets/{bucket_id}/remove_from_peer method detail

Example

Request parameters
Name Type Default Description
peer (required) GUID N/A Peer GUID


Response data keys

None. If the peer parameter is missing from the request, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': The following required arguments are missing: peer.</msg>
  </messages>
</response>

[ Top ]


cluster/master/control/control/rebalance_primaries

https://<host>:<mPort>/services/cluster/master/control/control/rebalance_primaries

Description

Rebalance primary buckets across peers.

For more information, see "Rebalance the indexer cluster primary buckets" in Managing Indexers and Clusters of Indexers.

Method summary

Method Description Formats
POST Rebalance primary buckets across all peers of this master. XML, JSON

POST cluster/master/control/control/rebalance_primaries method detail

Example

Request parameters

None

Response data keys

None

[ Top ]


cluster/master/control/control/remove_peers

https://<host>:<mPort>/services/cluster/master/control/control/remove_peers

Description

Remove one or more peers.

See also

cluster/master/peers

Method summary

Method Description Formats
POST Remove one or more peers. XML, JSON

POST cluster/master/control/control/remove_peers method detail

Example

Request parameters
Name Type Default Description
peers
required
String One or more comma-separated peer GUIDs.
Response data keys

None

Application usage

If peer status is not Down or GracefulShutdown, the interface returns the following error message:

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermastercontrol': Remove aborted, Reason: Peer=<hostname> with guid=<peerID> cannot be removed. Peer has status=Up. Only peers with status=Down (or) GracefulShutdown can be removed.</msg>
  </messages>
</response>

[ Top ]



cluster/master/fixup

https://<host>:<mPort>/services/cluster/master/fixup

Description

Access a list of buckets on a specific fixup priority level. Bucket fixups are processed in order of priority level. See Request parameters below for priority level details.

When you access a particular fixup level, buckets may appear in it even though they do not need fixup at this level. Initially, each bucket requiring fixup is added to all levels, even though it might only require processing in a subset of all levels. As the bucket is processed through a level, it is deleted from that level.

Method summary

Method Description Formats
GET List buckets on the specified fixup level. XML, JSON

GET cluster/master/fixup method detail

Example


Request parameters

Pagination and filtering parameters can be used with this method.

Name Datatype Default Description
level String N/A Required. Fixup priority level. Use one of the following level values, listed in order of priority.
  • streaming : Hot buckets that need to be rolled or have their size committed.
  • data_safety : Buckets without at least two rawdata copies.
  • generation : Buckets without a primary copy.
  • replication_factor : Buckets without replication factor number of copies.
  • search_factor : Buckets without search factor number of copies.
  • checksum_sync : Level for syncing a bucket's delete files across all peers that have this bucket. Syncing is determined based on the checksum of all of the delete files.
index String N/A Optional. Index name.
Response data keys

For each bucket in the specified fixup level, the response includes the following details for the initial time when the bucket went into the fixup level and the latest time that the bucket was checked.

Name Description
id Bucket id.
reason Initial or latest reason for the bucket being on this fixup level.
timestamp Timestamp for initial bucket addition to fixup list or latest bucket check.

cluster/master/generation

https://<host>:<mPort>/services/cluster/master/generation

Description

Access current generation cluster master information.

Method summary

Method Description Formats
GET List peer nodes participating in the current generation for this master. XML, JSON
POST Create a cluster generation. XML, JSON

GET cluster/master/generation method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
generation_id The ID for the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.


POST cluster/master/generation method detail

Example

Request parameters
Name Type Default Description
name
required
String The URI of the searchhead node of a cluster upon which to create a new generation.
generation_poll_interval Number How often, in seconds, the searchhead polls the master for generation information.

Defaults to 60 seconds.

label String Server name for the Splunk Enterprise instance specified by the name attribute.
mgmt_port String The managment port of searchhead node in a cluster upon which you are creating a new generation.
register_search_address String The address on which a peer node is available as search head.

This is useful in the cases where a splunk host machine has multiple interfaces and only one of them can be reached by another splunkd instance.

Response data keys
Name Description
generation_id The ID for the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.

replication_factor_met Indicates if the replication factor was met for the cluster.
search_factor_met Indicates if the search factor was met for the cluster.
was_forced Indicates next generation was forcibly committed.

[ Top ]


cluster/master/generation/{name}

https://<host>:<mPort>/services/cluster/master/generation/{name}

Description

Access information about a peer node participating in the current generation for the specified search head GUID.

Method summary

Method Description Formats
GET List peer node information of the specified search head GUID. XML, JSON
POST Create a new generation for the specified search head GUID. XML, JSON

GET cluster/master/generation/{name} method detail

Example

Request parameters

None

Response data keys
Name Description
generation_id The ID of the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.


POST cluster/master/generation/{name} method detail

Example

Request parameters
Name Type Default Description
generation_poll_interval Number How often, in seconds, the searchhead polls the master for generation information.

Defaults to 60 seconds.

label String Server name for the search head specified by {name}.
mgmt_port String The managment port of searchhead node in a cluster upon which you are creating a new generation.
register_search_address String The address on which a peer node is available as search head.

This is useful in the cases where a splunk host machine has multiple interfaces and only one of them can be reached by another splunkd instance.

Response data keys
Name Description
generation_id The ID for the current generation for this master.
generation_peers Lists the peers for this generation of the cluster.
pending_generation_id The next generation ID used by the master when committing a new generation.

This value is useful for debugging.

pending_last_attempt The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason The reason why this peer failed to commit to the pending generation.

This parameter is EMPTY if no such attempt was made.

replication_factor_met Indicates if the replication factor was met for the cluster.
search_factor_met Indicates if the search factor was met for the cluster.
was_forced Indicates next generation was forcibly committed.

[ Top ]


cluster/master/indexes

https://<host>:<mPort>/services/cluster/master/indexes

Description

Access cluster index information.

Method summary

Method Description Formats
GET Lists cluster indices. XML, JSON

GET cluster/master/indexes method detail

Example

Request parameters

None

Response data keys
Attribute Description
buckets_with_excess_copies Number of distinct buckets that have one or more excess replication copies.
buckets_with_excess_searchable_copies Number of distinct buckets that have one or more excess searchable copies.
index_size Size of the index
is_searchable When every bucket in the index has a primary, the index is considered "searchable".
non_site_aware_buckets_in_site_aware_cluster Number of buckets created when the cluster was not in a multisite config. (Included only when the cluster is in multisite config.)
num_buckets Total number of distinct buckets.
replicated_copies_tracker Displays how many distinct buckets have X number of copies.
AttributeDescription
actual_copies_per_slotNumber of buckets with X copies.
expected_total_per_slotExpected number of buckets with X copies.
searchable_copies_tracker Displays how many distinct buckets have X number of searchable copies.
AttributeDescription
actual_copies_per_slotNumber of buckets with X searchable copies.
expected_total_per_slotExpected number of buckets with X searchable copies.
sort_order Used by UI.
total_excess_bucket_copies Total number of excess copies for all buckets.
total_excess_searchable_copies Total number of excess searchable copies for all buckets.

[ Top ]


cluster/master/indexes/{name}

https://<host>:<mPort>/services/cluster/master/indexes/{name}

Description

Access specific cluster index information.

Method summary

Method Description Formats
GET Lists index information. XML, JSON

GET cluster/master/indexes/{name} method detail

Example

Request parameters

None

Response data keys
Attribute Description
buckets_with_excess_copies Number of distinct buckets that have one or more excess replication copies.
buckets_with_excess_searchable_copies Number of distinct buckets that have one or more excess searchable copies.
index_size Size of the index
is_searchable When every bucket in the index has a primary, the index is considered "searchable".
non_site_aware_buckets_in_site_aware_cluster Number of buckets created when the cluster was not in a multisite config. (Included only when the cluster is in multisite config.)
num_buckets Total number of distinct buckets.
replicated_copies_tracker Displays how many distinct buckets have X number of copies.
AttributeDescription
actual_copies_per_slotNumber of buckets with X copies.
expected_total_per_slotExpected number of buckets with X copies.
searchable_copies_tracker Displays how many distinct buckets have X number of searchable copies.
AttributeDescription
actual_copies_per_slotNumber of buckets with X searchable copies.
expected_total_per_slotExpected number of buckets with X searchable copies.
sort_order Used by UI.
total_excess_bucket_copies Total number of excess copies for all buckets.
total_excess_searchable_copies Total number of excess searchable copies for all buckets.

[ Top ]


cluster/master/info

https://<host>:<mPort>/services/cluster/master/info

Description

Access information about cluster master node.

Method summary

Method Description Formats
GET List cluster master node details. XML, JSON

GET cluster/master/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
active_bundle Provides information about the active bundle for this master.
bundle_creation_time_on_master The time, in epoch seconds, when the bundle was created on the master.
bundle_validation_errors_on_master A list of bundle validation errors.
bundle_validation_in_progress Indicates if bundle validation is in progress.
bundle_validation_on_master_succeeded Indicates whether the master succeeded validating bundles.
data_safety_buckets_to_fix Lists the buckets to fix for the completion of data safety.
gen_commit_buckets_to_fix The buckets to be fixed before the next generation can be committed.
indexing_ready_flag Indicates if the cluster is ready for indexing.
initialized_flag Indicates if the cluster is initialized.
label The name for the master that is displayed in the Splunk Enterprise Manager page.
latest_bundle The most recent information reflecting any changes made to the master-apps configuration bundle.

In steady state, this is equal to active_bundle. If it is not equal, then pushing the latest bundle to all peers is in process (or needs to be started).

maintenance_mode Indicates if the cluster is in maintenance mode.
reload_bundle_issued Indicates if the bundle issued is being reloaded.
rep_count_buckets_to_fix Number of buckets to fix on peers.
rolling_restart_flag Indicates whether the master is restarting the peers in a cluster.
search_count_buckets_to_fix Number of buckets to fix to satisfy the search count.
service_ready_flag Indicates whether the master is ready to begin servicing, based on whether it is initialized.
start_time Timestamp corresponding to the creation of the master.

[ Top ]


cluster/master/peers

https://<host>:<mPort>/services/cluster/master/peers

Description

Access cluster master peers.

See also

cluster/master/control/control/remove_peers

Method summary

Method Description Formats
GET List cluster master peers. XML, JSON

GET cluster/master/peers method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
active_bundle_id The ID of the configuration bundle currently being used by the master.
apply_bundle_status Bundle status enumeration.
base_generation_id The initial bundle generation ID recognized by this peer. Any searches from previous generations fail.

The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.

bucket_count Count of the number of buckets on this peer, across all indexes.
bucket_count_by_index Count of the number of buckets by index on this peer.
delayed_buckets_to_discard List of bucket IDs waiting to be discarded on this peer.
fixup_set The set of buckets that need repair once you take the peer offline.
heartbeat_started Flag indicating if this peer has started heartbeating.
host_port_pair The host and port advertised to peers for the data replication channel.

Can be either of the form IP:port or hostname:port.

is_searchable Flag indicating if this peer belongs to the current committed generation and is searchable.
label The name for the peer that is displayed in the Splunk Enterprise Manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer.
latest_bundle_id The ID of the configuration bundle this peer is using.
pending_job_count Used by the master to keep track of pending jobs requested by the master to this peer.
primary_count Number of buckets for which the peer is primary in its local site, or the number of buckets that return search results from same site as the peer.
primary_count_remote Number of buckets for which the peer is primary that are not in its local site.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
search_state_counter Lists the number of buckets on the peer for each search state for the bucket.

Possible values for search state include:

Searchable
Unsearchable
site To which site the peer belongs.
status Indicates the status of the peer.

Valid values are:

Up
Down
Pending
Detention
Restarting
DecommAwaitPeer
DecommFixingBuckets
Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status.

Possible values for bucket status:

Complete: complete (warm/cold) bucket
NonStreamingTarget: target of replication for already completed (warm/cold) bucket
PendingTruncate: bucket pending truncation
PendingDiscard: bucket pending discard
Standalone: bucket that is not replicated
StreamingError: copy of streaming bucket where some error was encountered
StreamingSource: streaming hot bucket on source side
StreamingTarget: streaming hot bucket copy on target side
Unset: uninitialized

[ Top ]


cluster/master/peers/{name}

https://<host>:<mPort>/services/cluster/master/peers/{name}

Description

Access specified peer.

Method summary

Method Description Formats
GET Get {name} peer information. XML, JSON

GET cluster/master/peers/{name} method detail

Example

Request parameters
Name Type Default Description
list_buckets Boolean Indicates whether to list the buckets for the peers to this master.
Response data keys
Name Description
active_bundle_id The ID of the configuration bundle currently being used by the master.
apply_bundle_status Bundle status enumeration.
base_generation_id The initial bundle generation ID recognized by this peer. Any searches from previous generations fail.

The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.

bucket_count Count of the number of buckets on this peer, across all indexes.
bucket_count_by_index Count of the number of buckets by index on this peer.
delayed_buckets_to_discard List of bucket IDs waiting to be discarded on this peer.
fixup_set The set of buckets that need repair once you take the peer offline.
heartbeat_started Flag indicating if this peer has started heartbeating.
host_port_pair The host and port advertised to peers for the data replication channel.

Can be either of the form IP:port or hostname:port.

is_searchable Flag indicating if this peer belongs to the current committed generation and is searchable.
label The name for the peer that is displayed in the Splunk Enterprise Manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer.
latest_bundle_id The ID of the configuration bundle this peer is using.
pending_job_count Used by the master to keep track of pending jobs requested by the master to this peer.
primary_count Number of buckets for which the peer is primary in its local site, or the number of buckets that return search results from same site as the peer.
primary_count_remote Number of buckets for which the peer is primary that are not in its local site.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
search_state_counter Lists the number of buckets on the peer for each search state for the bucket.

Possible values for search state include:

Searchable
Unsearchable
site To which site the peer belongs.
status Indicates the status of the peer.

Valid values are:

Up
Down
Pending
Detention
Restarting
DecommAwaitPeer
DecommFixingBuckets
Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status.

Possible values for bucket status:

Complete: complete (warm/cold) bucket
NonStreamingTarget: target of replication for already completed (warm/cold) bucket
PendingTruncate: bucket pending truncation
PendingDiscard: bucket pending discard
Standalone: bucket that is not replicated
StreamingError: copy of streaming bucket where some error was encountered
StreamingSource: streaming hot bucket on source side
StreamingTarget: streaming hot bucket copy on target side
Unset: uninitialized

[ Top ]


cluster/master/sites

https://<host>:<mPort>/servicescluster/master/sites

Description

Access cluster site information.

Method summary

Method Description Formats
GET List available cluster sites. XML, JSON

GET cluster/master/sites method detail

Example

Request parameters

None

Response data keys
Name Description
peers Peers list of host:port and server name.

[ Top ]


cluster/master/sites/{name}

https://<host>:<mPort>/services/cluster/master/sites/{name}

Description

Access specific cluster site information.

Method summary

Method Description Formats
GET List specific cluster site information. XML, JSON

GET cluster/master/sites/{name} method detail

Example

Request parameters

None

Response data keys
Name Description
peers Site peer reference, for each peer:
AttributeDescription
host_port_pairPeer port number.
server_namePeer server name.

[ Top ]


cluster/searchhead/generation

https://<host>:<mPort>/services/cluster/searchhead/generation

Description

Access peer information in a cluster searchhead.

Method summary

Method Description Formats
GET List peers available to a cluster searchhead. XML, JSON

GET cluster/searchhead/generation method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
generation_id The current generation ID for this searchhead, which is part of a cluster configuration.

The search head uses this information to determine which buckets to search across.

generation_peers List of peer nodes for the current generation in the cluster configuration for this searchhead.

[ Top ]


cluster/searchhead/generation/{name}

https://<host>:<mPort>/services/cluster/searchhead/generation/{name}

Description

Access peer of the master URI.

Method summary

Method Description Formats
GET Get {name} searchhead generation ID and generation peers. XML, JSON

GET cluster/searchhead/generation/{name} method detail

Example

Request parameters

None

Response data keys
Name Description
generation_id The current generation ID for this searchhead, which is part of a cluster configuration.

The search head uses this information to determine which buckets to search across.

generation_peers List of peer nodes for the current generation in the cluster configuration for this searchhead.

[ Top ]


cluster/searchhead/searchheadconfig

https://<host>:<mPort>/services/cluster/searchhead/searchheadconfig

Description

Access cluster searchhead node configuration.

Method summary

Method Description Formats
GET List this cluster search head node configuration. XML, JSON
POST Configure this server as a cluster searchhead node. XML, JSON

GET cluster/searchhead/searchheadconfig method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

None


POST cluster/searchhead/searchheadconfig method detail

Example

Request parameters
Name Type Default Description
name
required
String The URI of the master node in the cluster.
secret
required
String Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master.

Corresponds to pass4SymmKey setting in server.conf.

Response data keys

None

[ Top ]


cluster/searchhead/searchheadconfig/{name}

https://<host>:<mPort>/services/cluster/searchhead/searchheadconfig/{name}

Description

Manage node in a cluster.

Method summary

Method Description Formats
DELETE Remove node from cluster. XML, JSON
GET List cluster search head node configuration. XML, JSON
POST Update cluster search head node configuration. XML, JSON

DELETE cluster/searchhead/searchheadconfig/{name} method detail

Example

Request parameters

None

Response data keys

None


GET cluster/searchhead/searchheadconfig/{name} method detail

Example

Request parameters

None

Response data keys

None


POST cluster/searchhead/searchheadconfig/{name} method detail

Request parameters
Name Type Default Description
master_uri String The URI of the master node in the cluster for which this searchhead is configured.
secret String Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master.

Corresponds to pass4SymmKey setting in server.conf.

Response data keys

None

[ Top ]


cluster/slave/buckets

https://<host>:<mPort>/services/cluster/slave/buckets

Description

Access cluster peers bucket configuration.

Method summary

Method Description Formats
GET List cluster peers bucket configuration. XML, JSON

GET cluster/slave/buckets method detail

Example

Request parameters
Name Type Default Description
generation_id String The generation ID for this peer. For each generation, the master server in a cluster configuration assigns generation IDs. A generation identifies which copies of a cluster's buckets are primary and therefore can participate in a search.

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
checksum Used internally to identify this bucket.
earliest_time Indicates the time of the earliest event in this bucket.
generation_id The generation ID for this peer.
generations A sparse list of generation id to bucket primacy for the given peer.
latest_time Indicates the time for the latest event in this bucket.
search_state Indicates if the bucket is searchable.

Possible values:

Searchable
Unsearchable
status Indicates the status of this bucket.

Possible values:

Complete: Copy of this bucket contains the full complement of information
StreamingSource: The copy of this bucket is sending data to peer nodes for replication
StreamingTarget: The copy of this bucket is receiving replicated data.
NonStreamingTarget: This copy of a warm bucket replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError: the copy of this bucket encountered errors while streaming data.
PendingTruncate: The master asked the peer to truncate this copy of the bucket to a certain size and is waiting for confirmation.
PendingDiscard: The master asked the peer to discard this copy of the bucket (for whatever reason, and is waiting for confirmation.
Standalone: A bucket in the cluster that is not replicated.

[ Top ]


cluster/slave/buckets/{name}

https://<host>:<mPort>/services/cluster/slave/buckets/{name}

Description

Manage peer buckets.

Method summary

Method Description Formats
DELETE Remove specified bucket from peer node. XML, JSON
GET List peer specified bucket information. XML, JSON

DELETE cluster/slave/buckets/{name} method detail

Example

Request parameters
Name Type Default Description
bucket_id
required
Sring The identifier for the bucket to remove.
Response data keys

None


GET cluster/slave/buckets/{name} method detail

Example

Request parameters
Name Type Default Description
generation_id String The generation ID for this peer. For each generation, the master server in a cluster configuration assigns generation IDs. A generation identifies which copies of a cluster's buckets are primary and therefore can participate in a search.
Response data keys
Name Description
checksum Used internally to identify this bucket.
earliest_time Indicates the time of the earliest event in this bucket.
generation_id The generation ID for this peer.
generations A sparse list of generation id to bucket primacy for the given peer.
latest_time Indicates the time for the latest event in this bucket.
search_state Indicates if the bucket is searchable.

Possible values:

Searchable
Unsearchable
status Indicates the status of this bucket.

Possible values:

Complete: Copy of this bucket contains the full complement of information
StreamingSource: The copy of this bucket is sending data to peer nodes for replication
StreamingTarget: The copy of this bucket is receiving replicated data.
NonStreamingTarget: This copy of a warm bucket replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError: the copy of this bucket encountered errors while streaming data.
PendingTruncate: The master asked the peer to truncate this copy of the bucket to a certain size and is waiting for confirmation.
PendingDiscard: The master asked the peer to discard this copy of the bucket (for whatever reason, and is waiting for confirmation.
Standalone: A bucket in the cluster that is not replicated.

[ Top ]


cluster/slave/control/control/re-add-peer

https://<host>:<mPort>/services/cluster/slave/control/control/re-add-peer

Description

Set the peer to re-add itself to the master. This syncs the peer's state, including its in-memory bucket state, to the master. By default, this resets the peer's primary bucket copies and the master reassigns them across the cluster. To keep the peer's existing primary bucket copies, use the optional clearMasks=false parameter.

This endpoint can be useful when the master and the peer have a state mismatch, for example when bucket information is not in sync between them.

Method summary

Method Description Formats
POST Re-add the cluster indexer to the cluster master. XML, JSON

Example

Request parameters
Name Type Default Description
clearMasks Boolean.
Use true or false.
true Optional. Indicates whether the master should reassign all primary bucket copies across all peers. The default true value prompts the master to reassign all primary bucket copies across all peers. Use false to re-add the peer but keep the existing primary bucket copies.


[ Top ]



cluster/slave/info

https://<host>:<mPort>/services/cluster/slave/info

Description

Access cluster peer node information.

Method summary

Method Description Formats
GET List peer information. XML, JSON

GET cluster/slave/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
active_bundle Current bundle being used by this peer.
base_generation_id The initial bundle generation ID recognized by this peer. Any searches from previous generations fail.

The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.

invalid_bundle_ids List of bundle ids with validation errors in the peer.
is_registered Indicates if this peer is registered with the master in the cluster.
last_heartbeat_attempt Timestamp for the last attempt to contact the master.
latest_bundle Lists information about the most recent bundle downloaded from the master.
restart_state Indicates whether the peer needs to be restarted to enable its cluster configuration.
status Indicates the status of the peer.

Possible values:

Up
Down
Pending
Detention
Restarting
DecommAvaitingPeer
DecommFixingBuckets
Decommissioned

[ Top ]

shcluster/captain/artifacts

https://<host>:<mPort>/services/shcluster/captain/artifacts

Description

Provides list of artifacts and replicas for a searchhead cluster.

An artifact in search head clustering is a managed search directory. Currently only scheduled search results directories are managed, and replicated according to replication policy. This endpoint can only be accessed on the captain. The artifacts listed are all the artifacts that are currently managed by the captain across the searchhead cluster, present on the various members. NB: adhoc searches are not considered artifacts and are not listed.

Method summary

Method Description Formats
GET Lists searchhead cluster artifacts and replicas XML, JSON

GET shcluster/captain/artifacts method detail

Example

Request parameters
Name Type Default Description
remote_sids
required
Bool Set this to true to return the searches that the captain is seeing. Will include adhoc searches on remote members.
Response data keys
artifact_size Artifact size, in bytes.
origin_guid Guid of the origin peer where this artifact was created/search was run.
peers Lists information about replicas of this artifact on members of this searchhead cluster.
service_after_time Artifact service/fixup is deferred until after this time.

[ Top ]

shcluster/captain/artifacts/{name}

https://<host>:<mPort>/services/shcluster/captain/artifacts/{name}

Description

Get artifact information for a specific artifact.

Method summary

Method Description Formats
GET Get artifact information, size, replicas and earliest service time. XML, JSON

GET shcluster/captain/artifacts/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
artifact_size Artifact size, in bytes.
origin_guid Guid of the origin peer where this artifact was created.
peers Lists information about artifacts on members of this captain.
service_after_time Artifact service is deferred until after this time.

[ Top ]

shcluster/captain/info

https://<host>:<mPort>/services/shcluster/captain/info

Description

Access information about searchhead cluster captain node.

Method summary

Method Description Formats
GET List searchhead cluster captain node details. XML, JSON

GET shcluster/captain/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
elected_captain Time when the current captain was elected
id Id of this SH cluster. This is used as the unique identifier for the Search Head Cluster in bundle replication and acceleration summary management.
initialized_flag Indicates if the searchhead cluster is initialized.
label The name for the captain that is displayed in the Splunk Enterprise Manager page.
maintenance_mode Indicates if the cluster is in maintenance mode.
min_peers_joined_flag Flag to indicate if more then replication_factor peers have joined the cluster.
peer_scheme_host_port URI of the current captain.
rolling_restart_flag Indicates whether the captain is restarting the members in a searchhead cluster.
service_ready_flag Indicates whether the captain is ready to begin servicing, based on whether it is initialized.
start_time Timestamp corresponding to the creation of the captain.

[ Top ]

shcluster/captain/jobs

https://<host>:<mPort>/services/shcluster/captain/jobs

Description

List running and recently finished jobs for all cluster members.

Method summary

Method Description Formats
GET Cluster-wide list of running and recently finished jobs XML, JSON

GET shcluster/captain/jobs method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each job:

ATTEMPT_[n] dispatch_time - The UTC time of dispatch for the job
errormsg - If the job failed, capturing the reason for failure
peer - GUID of the member that the job was sent to
sid - the search id of this attempt
success - a boolean for success/failure of the job
job_state Job State can be SCHEDULED/DISPATCHED/COMPLETED. A SCHEDULED job has been received by the captain from the scheduler to schedule. A DISPATCHED job has started to run on a remote member. A COMPLETED job has finished running on the remote member.
saved_search The name of the saved-search from the associated savedsearches.conf file.
savedsearchtype The scheduler manages three kinds of scheduled jobs, regular savedsearch for both realtime and historical, autosummary report acceleration build searches, and tsidx tsidx build searches.
search_app The application in which the savedsearch was created.
search_owner The owner of the saved search.

[ Top ]

shcluster/captain/jobs/{name}

https://<host>:<mPort>/services/shcluster/captain/jobs/{name}

Description

Get running and recently finished jobs for {name} cluster.

Method summary

Method Description Formats
GET Get running and recently finished jobs. XML, JSON

GET shcluster/captain/jobs/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
ATTEMPT_[n] dispatch_time - The UTC time of dispatch for the job
errormsg - If the job failed, capturing the reason for failure
peer - GUID of the member that the job was sent to
sid - the search id of this attempt
success - a boolean for success/failure of the job
job_state Job State can be SCHEDULED/DISPATCHED/COMPLETED. A SCHEDULED job has been received by the captain from the scheduler to schedule. A DISPATCHED job has started to run on a remote member. A COMPLETED job has finished running on the remote member.
saved_search The name of the saved-search from the associated savedsearches.conf file.
savedsearchtype The scheduler manages three kinds of scheduled jobs, regular savedsearch for both realtime and historical, autosummary report acceleration build searches, and tsidx tsidx build searches.
search_app The application in which the savedsearch was created.
search_owner The owner of the saved search.

[ Top ]

shcluster/captain/members

https://<host>:<mPort>/services/shcluster/captain/members

Description

Lists the search head cluster members.

Method summary

Method Description Formats
GET List cluster members. XML, JSON

GET shcluster/captain/members method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
adhoc_searchhead Flag to indicate if this member does not run scheduled searches.
advertise_restart_required Flag to indicate if this peer advertised that it needed a restart.
artifact_count Number of artifacts on this peer
delayed_artifacts_to_discard List of artifacts waiting to be deleted from this peer.
fixup_set N/A
host_port_pair The host and management port advertised by this peer.
kv_store_host_port Host and port of the kv store instance of this member.
label The name for this member that is displayed in the Splunk Enterprise Manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer
peer_scheme_host_port URI of the current captain.
pending_job_count Used by the captain to keep track of pending jobs requested by the captain to this member.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
site N/A
status Indicates the status of the member.

Valid values are:

Up
Down
Pending
Detention
Restarting
DecommAwaitPeer
DecommFixingBuckets
Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status.

Possible values for bucket status:

Complete: complete (warm/cold) bucket
NonStreamingTarget: target of replication for already completed (warm/cold) bucket
PendingTruncate: bucket pending truncation
PendingDiscard: bucket pending discard
Standalone: bucket that is not replicated
StreamingError: copy of streaming bucket where some error was encountered
StreamingSource: streaming hot bucket on source side
StreamingTarget: streaming hot bucket copy on target side
Unset: uninitialized

[ Top ]

shcluster/captain/members/{name}

https://<host>:<mPort>/services/shcluster/captain/members/{name}

Description

Get information about the {name} searchhead cluster member.

Method summary

Method Description Formats
GET Get information about the {name} searchhead cluster member. XML, JSON

GET shcluster/captain/members/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
adhoc_searchhead Flag to indicate if this member does not run scheduled searches.
advertise_restart_required Flag to indicate if this peer advertised that it needed a restart.
artifact_count Number of artifacts on this peer.
delayed_artifacts_to_discard List of artifacts waiting to be deleted from this peer.
fixup_set N/A
host_port_pair The host and management port advertised by this peer.
kv_store_host_port Host and port of the kv store instance of this member.
label The name for this member displayed in the Splunk Enterprise Manager page.
last_heartbeat Timestamp for last heartbeat recieved from the peer
peer_scheme_host_port URI of the current captain.
pending_job_count Used by the master to keep track of pending jobs requested by the master to this peer.
replication_count Number of replications this peer is part of, as either source or target.
replication_port TCP port to listen for replicated data from another cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
site N/A
status Indicates the status of the member.

Valid values are:

Up
Down
Pending
Detention
Restarting
DecommAwaitPeer
DecommFixingBuckets
Decommissioned
status_counter Lists the number of buckets on the peer for each bucket status.

Possible values for bucket status:

Complete: complete (warm/cold) bucket
NonStreamingTarget: target of replication for already completed (warm/cold) bucket
PendingTruncate: bucket pending truncation
PendingDiscard: bucket pending discard
Standalone: bucket that is not replicated
StreamingError: copy of streaming bucket where some error was encountered
StreamingSource: streaming hot bucket on source side
StreamingTarget: streaming hot bucket copy on target side
Unset: uninitialized

[ Top ]

shcluster/config

https://<host>:<mPort>/services/shcluster/config

Description

List searchhead cluster node configuration.

Method summary

Method Description Formats
GET List searchhead cluster node configuration. XML, JSON

GET shcluster/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
cxn_timeout Low-level timeout, in seconds, for establishing connection between searchhead cluster nodes. Defaults to 60 seconds.
disabled Indicates if this node is disabled.
heartbeat_period Only valid for member nodes in a searchhead cluster. The time, in seconds, that a member attempts to send a heartbeat to the captain
heartbeat_timeout Only valid for the captain node in a searchhead cluster configuration. The time, in seconds, before a captain considers a member down. Once a member is down, the captain initiates steps to replicate artifacts from the dead member to its live members. Defaults to 60 seconds.
id Id of the SH cluster this member is a part of.
max_peer_rep_load Maximum number of replications that can be ongoing as a target.
mode slave | searchhead | disabled) Defaults to disabled.

Sets operational mode for this searchhead cluster node. Only one captain may exist per searchhead cluster.

percent_peers_to_restart Percentage of peers to restart at the same time when doing a rolling restart.
ping_flag For internal use to facilitate communication between the captain and members.
quiet_period The time, in seconds, that a captain waits for members to add themselves to the searchhead cluster.
rcv_timeout Low-level timeout, in seconds, for receiving data between searchhead cluster nodes. Defaults to 60 seconds.
register_replication_address Valid only for nodes configured as members. The address on which a member is available for accepting replication data. This is useful in the cases where a member host machine has multiple interfaces and only one of them can be reached by another splunkd instance.
rep_cxn_timeout Low-level timeout, in seconds, for establishing a connection for replicating data.
rep_max_rcv_timeout Maximum cumulative time, in seconds, for receiving acknowledgement data from members. Defaults to 600s.
rep_max_send_timeout Maximum time, in seconds, for sending replication slice data between searchhead cluster nodes. Defaults to 600s.
rep_rcv_timeout Low-level timeout, in seconds, for receiving data between searchhead cluster nodes.
rep_send_timeout Low-level timeout, in seconds, for sending replication data between searchhead cluster nodes. Defaults to 5 seconds.
replication_factor Only valid for nodes configured as a captain.

Determines how many copies of raw data are created in the searchhead cluster. This could be less than the number of searchhead cluster members.

Must be greater than 0 and greater than or equal to the search factor. Defaults to 3.

replication_port TCP port to listen for replicated data from another searchhead cluster member.
replication_use_ssl Indicates whether to use SSL when sending replication data.
restart_timeout Only valid for nodes configured as a captain. The amount of time, in seconds, the captain waits for a member to come back when the member is restarted (to avoid the overhead of trying to fix the artifacts that were on the member). Defaults to 600 seconds.

Note: This only works if the member is restarted from Splunk Web.

secret Secret shared among the nodes in the searchhead cluster to prevent any arbitrary node from connecting to the searchhead cluster. If a member or searchhead is not configured with the same secret as the captain, it is not able to communicate with the captain.

Corresponds to pass4SymmKey setting in server.conf.

send_timeout Low-level timeout, in seconds, for sending data between searchhead cluster nodes. Defaults to 60 seconds.

[ Top ]

shcluster/member/artifacts

https://<host>:<mPort>/services/shcluster/member/artifacts

Description

Manage searchhead cluster member artifact configuration.

Method summary

Method Description Formats
GET List searchhead cluster members artifact configuration. XML, JSON

GET shcluster/member/artifacts method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each member:

status Indicates the status of this artifact. Possible values:
Complete: Copy of this artifact contains the full complement of information.
StreamingSource: The copy of this artifact is sending data to member nodes for replication.
StreamingTarget: The copy of this artifact is receiving replicated data.
NonStreamingTarget: This copy of a warm artifact replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError: the copy of this artifact encountered errors while streaming data.
PendingTruncate: The captain asked the member to truncate this copy of the artifact to a certain size and is waiting for confirmation.
PendingDiscard: The captain asked the member to discard this copy of the artifact (for whatever reason, and is waiting for confirmation.
Standalone: A artifact in the searchhead cluster that is not replicated.

[ Top ]

shcluster/member/artifacts/{name}

https://<host>:<mPort>/services/shcluster/member/artifacts/{name}

Description

Get {name} member artifact configuration.

Method summary

Method Description Formats
GET List {name} member artifact information. XML, JSON

GET shcluster/member/artifacts/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
status Indicates the status of this artifact. Possible values:
Complete: Copy of this artifact contains the full complement of information.
StreamingSource: The copy of this artifact is sending data to member nodes for replication.
StreamingTarget: The copy of this artifact is receiving replicated data.
NonStreamingTarget: This copy of a warm artifact replication is in progress. Once replication is complete, the status changes to Complete.
StreamingError: the copy of this artifact encountered errors while streaming data.
PendingTruncate: The captain asked the member to truncate this copy of the artifact to a certain size and is waiting for confirmation.
PendingDiscard: The captain asked the member to discard this copy of the artifact (for whatever reason, and is waiting for confirmation.
Standalone: A artifact in the searchhead cluster that is not replicated.

[ Top ]

shcluster/member/consensus

https://<host>:<mPort>/services/shcluster/member/consensus

Description

Get latest cluster configuration from the raft consensus protocol.

Method summary

Method Description Formats
GET Get latest cluster configuration from the raft consensus protocol. XML, JSON

GET shcluster/member/consensus method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each member:

configuration_id Unique id for this configuration.
servers_list Comma-separated list of members that are part of the cluster. Each member is listed as scheme://host:port

[ Top ]

shcluster/member/info

https://<host>:<mPort>/services/shcluster/member/info

Description

Access searchhead cluster member node information.

Method summary

Method Description Formats
GET List member information. XML, JSON

GET shcluster/member/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each member:

adhoc_searchhead Flag that indicates if this member can run scheduled searches.
is_registered Indicates if this member is registered with the searchhead cluster captain.
last_heartbeat_attempt Timestamp for the last attempt to contact the captain.
maintenance_mode N/A
peer_load_stats_gla_15m Number of scheduled searches run in the last 15 minutes.
peer_load_stats_gla_1m Number of scheduled searches run in the last one minute.
peer_load_stats_gla_5m Number of scheduled searches run in the last five minutes.
peer_load_stats_max_runtime N/A
peer_load_stats_num_autosummary N/A
peer_load_stats_num_historical N/A
peer_load_stats_num_realtime N/A
peer_load_stats_num_running N/A
peer_load_stats_total_runtime N/A
restart_state Indicates whether the member needs to be restarted to enable its searchhead cluster configuration.
status Indicates the status of the member. Possible values:
Up
Down
Pending
Detention
Restarting
DecommAvaitingPeer
DecommFixingBuckets
Decommissioned

[ Top ]

PREVIOUS
Application endpoint examples
  NEXT
Cluster endpoint examples

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters