Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Deployment endpoint descriptions

Manage deployment servers and clients.

A deployment server configures a deployment client. Deployment clients and servers can reside on separate, distributed, Splunk platform instances or can reside on the same instance.

  • Note: Username and password authentication is required for most endpoints and REST operations. Additional capability or role-based authorization may also be required, particularly for POST or DELETE operations.

deployment/client

https://<host>:<mPort>/services/deployment/client

Description

List deployment client configuration and status.

Method summary

Method Description Formats
GET Get deployment client list with enabled status, server class, and host and port number of each. XML, JSON

GET deployment/client method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each deployment client:

Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled
serverClasses List of member server classes for app download authorization.
targetUri Host and port number (<host>:<port>).

[ Top ]


deployment/client/config

https://<host>:<mPort>/services/deployment/client/config

Description

Get deployment client configuration and status.

Method summary

Method Description Formats
GET Get deployment client enabled status, server class for app distribution, and host and port number. XML, JSON

GET deployment/client/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled
serverClasses List of member server classes for app download authorization.
targetUri Host and port number (<host>:<port>).

[ Top ]


deployment/client/config/listIsDisabled

https://<host>:<mPort>/services/deployment/client/config/listIsDisabled

Description

Get deployment client status.

Method summary

Method Description Formats
GET Get deployment client disabled status. XML, JSON

GET deployment/client/config/listIsDisabled method detail

Example

Request parameters

None

Response data keys
Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled

[ Top ]


deployment/client/config/reload

Description

Access information on reloading the named client.

Method summary

Method Description Formats
POST Access client reload information XML, JSON

POST deployment/client/config/reload

Example

Request parameters

No parameters for this request.

Response keys
Status Code Description
200 Endpoint returned successfully.
400 Request error. See response body for details.
401 Authentication failure: must pass valid credentials with request.
403 Insufficient permissions to access resource.
404 Specified resoruce does not exist.
409 Request error: this operation is invalid for this item. See response body for details.
500 Internal server error. See response body for details.

deployment/client/{name}/reload

https://<host>:<mPort>/services/deployment/client/{name}/reload

Description

Restart and reload {name} deployment client.

Method summary

Method Description Formats
POST Restart {name} deployment client and reload configuration from disk. XML, JSON

POST deployment/client/{name}/reload method detail

Example

Request parameters

None

Response data keys
Name Description
disabled Disabled status:
0 = Enabled
1 = Disabled
serverClasses List of member server classes for app download authorization.
targetUri Host and port number (<host>:<port>).

[ Top ]


deployment/server/applications

https://<host>:<mPort>/services/deployment/server/applications

Description

Selectively list distributed apps.

Method summary

Method Description Formats
GET Selectively list distributed apps, including distributed state information. XML, JSON

GET deployment/server/applications method detail

Example

Request parameters
Name Type Default Description
clientId String Select apps that match clientId.
hasDeploymentError Boolean Select apps according to deployment fault status:
0 = Do not include apps with a deployment fault indication.
1 = Include apps with a deployment fault indication.

Pagination and filtering parameters can be used with this method.

Response data keys

For each app listed:

Name Description
archive Disk location of the archived version of the app.
clientId Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes.
hasDeploymentError Indicates deployment fault status on at least one deployment client:
0 = Do not include apps with a deployment fault indication.
1 = Include apps with a deployment fault indication.
loadtime Last deployment server app loaded or reloaded date and time.
restartSplunkWeb Restart Splunk Web indication:
0 = Do not restart Splunk Web.
1 = Restart Splunk Web.
restartSplunkd Restart splunkd indication:
0 = Do not restart splunkd.
1 = Restart splunkd.
serverclasses List of server classes associated with the application.
size Size on disk of the compressed app (bundle), in bytes.
stateOnClient App enablement status:
0 = Not enabled.
1 = Enabled.
Application usage

An application not mapped to serverclasses is not loaded so loadtime is 0.

[ Top ]


deployment/server/applications/{name}

https://<host>:<mPort>/services/deployment/server/applications/{name}

Description

Get or update distribution information for {name} app.

Method summary

Method Description Formats
GET Get {name} app distribution information. XML, JSON
POST Update {name} app distribution information. XML, JSON

GET deployment/server/applications/{name} method detail

Example

Request parameters

None

Response data keys
Name Description
Attribute Description
archive Disk location of archived version of the app.
clientId Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes.
hasDeploymentError Indicates deployment fault status on at least one deployment client:
0 = Do not include apps with a deployment fault indication.
1 = Include apps with a deployment fault indication.
loadtime Last deployment server app loaded or reloaded date and time.
restartSplunkWeb Restart Splunk Web indication:
0 = Do not restart Splunk Web.
1 = Restart Splunk Web.
restartSplunkd Restart splunkd indication:
0 = Do not restart splunkd.
1 = Restart splunkd.
serverclasses List of server classes associated with the application.
size Size on disk of the compressed app (bundle), in bytes.
stateOnClient App enablement status:
0 = Not enabled.
1 = Enabled.
Application usage

An application not mapped to serverclasses is not loaded so loadtime is 0.


POST deployment/server/applications/{name} method detail

Example

Request parameters
Name Type Default Description
blacklist.* String List of hosts to exclude when mapping application to a server class. For each blacklist, replace the wildcard (*) with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.
continueMatching Boolean Configuration layering indication, across classes and server-specific settings:
true = [Default] Configuration lookups continue matching server classes after the first match.
false = Use the first match, only.
deinstall Boolean Remove mapping indication:
true = Remove mapping of {name} from all server classes and delete it from client target repositories.
false = Do not remove mapping of {name}.
filterType Enum Filter execution order:
whitelist = Whitelist filters are applied before blacklist filters.
blacklist = Blacklist filters are applied before whitelist filters.
machineTypesFilter String Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.

Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included.

Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter.

The patterns are PCRE regular expressions, with the following aids for easier entry:

  • You can specify '.' to mean '\\.'
  • You can specify '*' to mean '.*'
  • Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation String The location on the deployment server to store the content that is to be deployed for this server class.

For example: $SPLUNK_HOME/etc/deployment-apps

restartSplunkWeb Boolean Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.

Defaults to false

restartSplunkd Boolean Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.

Defaults to false

serverclass String The name of the server class to which the application is mapped.

Do not specify this parameter if deinstall is true.

stateOnClient Enum Valid values are (enabled | disabled | noop).
  • enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server.
  • disabled: Sets the application state to disabled on the client, regardless of state on the deployment server.
  • noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation String The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used. That is, defaults to:

$SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk Enterprise instance)

Useful only with complex (for example, tiered) deployment strategies.

tmpFolder String Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

unmap Boolean Indicates whether to remove the mapping of the application to the specified server class.
whitelist.* String List of hosts to accept for this server class.

For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.

Response data keys
Name Description
archive Specifies the location of the compressed version (bundle) of the app.
blacklist.* Regular expressions used to exclude, when mapping this application to a client.

If a client matches any of the blacklist regular expressions, it does not receive the application. The * is replaced by an integral ordinal number.

continueMatching If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used.
filterType blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

See description for the filterType POST parameter for more information.

loadtime Specifies the date and time the application was last loaded (or reloaded) by the deployment server.

An application not mapped to any serverclasses does not get loaded, thus its loadtime attribute is 0; in epoch terms, which is 01 Jan 1970 at midnight GMT.

machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
serverclass The name of the server class to which the application is mapped.
serverclasses List of server classes associated with the application.
size Indicates in bytes the size on disk of the compressed version (bundle) of the application.
stateOnClient Specifies whether the deployment client is enabled or disabled.
targetRepositoryLocation The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used.

tmpFolder Working folder used by deployment server.
whitelist.* Regular expressions used to accept, when mapping this application to a client.

If a client matches any of the whitelist regular expressions, it accepts the application. The * is replaced by an integral ordinal number.

Application usage

When continueMatching is true, matching is in the order in which server classes are defined.

The whitelist setting indicates a filtering strategy that includes a subset:

  • Items are not considered to match the server class by default.
  • Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
  • Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.

The blacklist setting indicates a filtering strategy that excludes a subset:

  • Items are considered to match the server class by default.
  • Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
  • Items that match any whitelist entry are considered to match the server class.

That is,

whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable

If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.

[ Top ]


deployment/server/clients

https://<host>:<mPort>/services/deployment/server/clients

Description

Provides access to information about clients to a deployment server.

Method summary

Method Description Formats
GET Lists information about clients to a deployment server. XML, JSON

GET deployment/server/clients method detail

Example

Request parameters
Name Type Default Description
application String Lists clients to the deployment server that have attempted to download the named application.
hasDeploymentError Boolean False Indicates whether to list only clients that have a deployment error.
maxPhonehome_latency_to_avgInterval_ratio Number List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter.
minLatestPhonehomeTime Number Lists clients for which there is a phone home message at the specified time or later, in epoch seconds. That is, list the client for the following condition:

  client latency ? (now?minLatestPhonehomeTime)

minPhonehome_latency_to_avgInterval_ratio Number List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses String Comma-separated list of serverclasses. List clients that are configured to receive an application to a listed serverclass.

The match is a logical OR of, for each Si, include C if C is sent an app A that maps to Si in serverclass.conf, if such an app existed.

The "would have" is per blacklist.n or whitelist.n/machineTypesFilter in serverclass.conf

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
applications List of applications deployed to the deployment client.
averagePhoneHomeInterval The average phone home interval, in seconds.
build The build number for the instance of Splunk Enterprise on the deployment client.
dns The DNS lookup name of the deployment client server.
guid Identifier for the deployment server client.
hasDeploymentError Specifies whether to check for clients with a deployment error.
hostname The host name of the deployment client server.
id ID for the client based on client name and IP address.
ip The IP address of the client to the deployment server.
lastPhoneHomeTime The last time the deployment client phones home to the deployment server, in epoch time.
mgmt The managment port for the deployment client.
minLatestPhonehomeTime Specifies in epoch seconds the minimum latency for a client to contact the deployment server.
minPhonehome_latency_to_avgInterval_ratio The minimum value specified for the ratio of the phone home latency to the average phone home interval.
name The name of the deployment client server.
serverclasses List of server classes for the deployment client.
utsname Machine type for the deployment server client.

[ Top ]


deployment/server/clients/countClients_by_machineType

https://<host>:<mPort>/services/deployment/server/clients/countClients_by_machineType

Description

Access information about deployment clients to this server according to the machine type of the client.

Method summary

Method Description Formats
GET Lists the count of deployment clients to this server by machine type. XML, JSON

GET deployment/server/clients/countClients_by_machineType method detail

Example

Request parameters

None

Response data keys
Name Description
counts The list of machine types for this deployment client, showing the count of each machine type.

[ Top ]


deployment/server/clients/countRecentDownloads

https://<host>:<mPort>/services/deployment/server/clients/countRecentDownloads

Description

Access the count of the number of downloads from this client to the deployment server during the last specified time period.

Method summary

Method Description Formats
GET Return the count of the number of downloads from this client to the deployment server during the last specified time period. XML, JSON

GET deployment/server/clients/countRecentDownloads method detail

Example

Request parameters
Name Type Default Description
application String Count the number of downloads for clients that have attempted to download the named application.
hasDeploymentError Boolean Indicates whether to count downloads for clients that have a deployment error.
maxAgeSecs
required
Number Age of the downloads to count, in seconds.
maxPhonehome_latency_to_avgInterval_ratio Number List the count of recent download by this client to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter
minLatestPhonehomeTime Number Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists the number of downloads for clients to the deployment server with a latency equal to or greater than specified by this parameter.
minPhonehome_latency_to_avgInterval_ratio Number List the number of recent downloads by clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses String Comma-separated list of server classes. Lists the number of recent downloads by clients to the deployment server that are configured to send an application to a listed serverclass.
Response data keys
Name Description
count The number of recent downloads.

[ Top ]


deployment/server/clients/{name}

https://<host>:<mPort>/services/deployment/server/clients/{name}

Description

Get client information or remove a client.

Method summary

Method Description Formats
DELETE Removes the specified client from the deployment server registry. The next time the client "phones home" the record is re-created. XML, JSON
GET Lists information about the named client to the deployment server. XML, JSON

DELETE deployment/server/clients/{name} method detail

Example

Request parameters

None

Response data keys

None


GET deployment/server/clients/{name} method detail

Example

Request parameters
Name Type Default Description
application String Lists information about this client with respect to the named application.
hasDeploymentError Boolean Indicates whether to list this client if has a deployment error.
maxPhonehome_latency_to_avgInterval_ratio Number List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter.
minLatestPhonehomeTime Number Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists information about the named client if it has a latency equal to or greater than specified by this parameter.
minPhonehome_latency_to_avgInterval_ratio Number List information about the named client to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses String Comma-separated list of serverclasses. Lists information about this client if it is configured to send an application to a listed serverclass.
Response data keys
Name Description
application The name of the application specified to filter the results of this call.
applications List of applications deployed to the deployment client.
averagePhoneHomeInterval The average phone home interval, in seconds.
build The build number for the instance of Splunk Enterprise on the deployment client.
dns The DNS lookup name of the deployment client server.
guid Identifier for the deployment server client.
hasDeploymentError Specifies whether to check for clients with a deployment error.
hostname The host name of the deployment client server.
id ID for the client based on client name and IP address.
ip The IP address of the client to the deployment server.
lastPhoneHomeTime The last time the deployment client phones home to the deployment server, in epoch time.
maxPhonehome_latency_to_avgInterval_ratio The maximum value specified for the ratio of the phone home latency to the average phone home interval.
mgmt The managment port for the deployment client.
minLatestPhonehomeTime Specifies in epoch seconds the minimum latency for a client to contact the deployment server.
minPhonehome_latency_to_avgInterval_ratio The minimum value specified for the ratio of the phone home latency to the average phone home interval.
name The name of the deployment client server.
serverClasses The list of server classes to which the client belongs.
serverclasses List of server classes for the deployment client.
utsname Machine type for the deployment server client.

[ Top ]


deployment/server/config

https://<host>:<mPort>/services/deployment/server/config

Description

Access server configuration information for deployment servers.

Method summary

Method Description Formats
GET List configuration information for all deployment servers. XML, JSON

GET deployment/server/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
currentDownloads The number of current downloads for this deployment server.
disabled Indicates whether the deployment server is disabled.
loadTime The time, in epoch seconds, the serverclass for this server was loaded.
repositoryLocation The location on the deployment server to store the content that is to be deployed.
whitelist.0 Lists the contents of whitelist.0.

[ Top ]


deployment/server/config/attributesUnsupportedInUI

https://<host>:<mPort>/services/deployment/server/config/attributesUnsupportedInUI

Description

Access deployment server attriutes that cannot be configured from Splunk Web.

Method summary

Method Description Formats
GET Lists deployment server attributes that cannot be configured from Splunk Web. XML, JSON

GET deployment/server/config/attributesUnsupportedInUI method detail

Example

Request parameters

None

Response data keys
Name Description
property The attribute that cannot be configured from Splunk Web.
reason The reason an attribute cannot be configured from Splunk Web.
stanza The stanza in serverclass.conf that lists deployment server attributes that cannot be configured from Splunk Web.

[ Top ]


deployment/server/config/listIsDisabled

https://<host>:<mPort>/services/deployment/server/config/listIsDisabled

Description

Access information as to whether the deployment server is enabled.

Method summary

Method Description Formats
GET List whether the deployment server is disabled. XML, JSON

GET deployment/server/config/listIsDisabled method detail

Example

Request parameters

None

Response data keys
Name Description
disabled Indicates if the deployment server is disabled.

[ Top ]


deployment/server/serverclasses

https://<host>:<mPort>/services/deployment/server/serverclasses

Description

Access information about server classes.

Method summary

Method Description Formats
GET List server classes for this deployment server. XML, JSON
POST Creates a server class. XML, JSON

GET deployment/server/serverclasses method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
blacklist-size The number of entires in the blacklist for this serverclass.
clientId ID of deployment client for this server class.
currentDownloads Number of applications currently downloaded.
hasDeploymentError Indicates whether the serverclass has at least one deployment error.
loadTime The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList List of applications stored at the location specified by repositoryLocation.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
stateOnClient Indicates whether this server class is enabled or disabled.
whitelist-size Specifies the number of entries in the whitelist for this server class.
whitelist.0 List of servers for whitelist.0 for this server class.

POST deployment/server/serverclasses method detail

Example

Request parameters
Name Type Default Description
name
required
String The name of the server class.
blacklist.* String List of hosts to exclude for this server class.

For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.

continueMatching Boolen Controls how configuration is layered across classes and server-specific settings.

If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true.

A serverClass can override this property and stop the matching.

filterType Enum Valid values: (whitelist | blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

The whitelist setting indicates a filtering strategy that pulls in a subset:

  • Items are not considered to match the server class by default.
  • Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
  • Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.

The blacklist setting indicates a filtering strategy that rules out a subset:

  • Items are considered to match the server class by default.
  • Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
  • Items that match any whitelist entry are considered to match the server class.

More briefly:

whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable

If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.

machineTypesFilter String Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.

Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included.

Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter.

The patterns are PCRE regular expressions, with the following aids for easier entry:

  • You can specify '.' to mean '\\.'
  • You can specify '*' to mean '.*'
  • Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation String The location on the deployment server to store the content that is to be deployed for this server class.

For example: $SPLUNK_HOME/etc/deployment-apps

restartSplunkWeb Boolean Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.

Defaults to false

restartSplunkd Boolean Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.

Defaults to false

stateOnClient Enum Valid values are (enabled | disabled | noop).
  • enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server.
  • disabled: Sets the application state to disabled on the client, regardless of state on the deployment server.
  • noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation String The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used. That is, defaults to:

$SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance

Useful only with complex (for example, tiered) deployment strategies.


tmpFolder String Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

whitelist.* String List of hosts to accept for this server class.

For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.

Response data keys
Name Description
blacklist-size The number of entries in the blacklist for this serverclass.
blacklist.* Regular expressions used to exclude for this server class.

If a client matches any of the blacklist regular expressions, it is not included in the server class. The * is replaced by an integral ordinal number.

continueMatching If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used.
currentDownloads Number of applications currently downloaded.
filterType blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

See description for the filterType POST parameter for more information.

loadTime The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList List of applications stored at the location specified by repositoryLocation.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
stateOnClient Specifies whether the deployment client is enabled or disabled.
targetRepositoryLocation The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used.

That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk Enterprise instance.

Useful only with complex (for example, tiered) deployment strategies.

tmpFolder Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

whitelist-size Specifies the number of entries in the whitelist for this server class.
whitelist.* Regular expressions used to accept for this server class.

If a client matches any of the whitelist regular expressions, it is included in the server class. The * is replaced by an integral ordinal number.

[ Top ]


deployment/server/serverclasses/rename

https://<host>:<mPort>/services/deployment/server/serverclasses/rename

Description

Rename a server class.

Method summary

Method Description Formats
POST Specify a new name for a server class. XML, JSON

POST deployment/server/serverclasses/rename method detail

Example

Request parameters
Name Type Default Description
newName
required
String The new name of the server class.
oldName
required
String The current name of the server class.
Response data keys

None

[ Top ]


deployment/server/serverclasses/{name}

https://<host>:<mPort>/services/deployment/server/serverclasses/{name}

Description

Manage the {name} serverclass.

Method summary

Method Description Formats
DELETE Remove the specfied server class from this deployment server. XML, JSON
GET List information about the named server class. XML, JSON
POST Update the named server class. XML, JSON

DELETE deployment/server/serverclasses/{name} method detail

Example

Request parameters

None

Response data keys

None


GET deployment/server/serverclasses/{name} method detail

Example

Request parameters
Name Type Default Description
clientId String GUID of a deployment client that is a member of the named server class. Lists information about the named server class with respect to this client.
hasDeploymentError Boolean Indicates whether to only list server classes that have a deployment error.
Response data keys
Name Description
blacklist-size Specifies the size of the blacklist for the named server class.
clientId ID of deployment client for this server class.
currentDownloads The number of entires in the blacklist for this serverclass.
hasDeploymentError Indicates whether the serverclass has at least one deployment error.
loadTime The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList List of applications stored at the location specified by repositoryLocation.
repositoryLocation The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb Indicates whether to restart Splunk Web.
restartSplunkd Indicates whether to restart splunkd.
stateOnClient Indicates whether this server class is enabled or disabled.
whitelist-size Specifies the number of entries in the whitelist for this server class.
whitelist.0 List of servers for whitelist.0 for this server class.

POST deployment/server/serverclasses/{name} method detail

Example

Request parameters
Name Type Default Description
blacklist.* String List of hosts to exclude for this server class.

For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.

continueMatching Boolen Controls how configuration is layered across classes and server-specific settings.

If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true.

A serverClass can override this property and stop the matching.

filterType Enum Valid values: (whitelist | blacklist)

Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters.

The whitelist setting indicates a filtering strategy that pulls in a subset:

  • Items are not considered to match the server class by default.
  • Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
  • Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.

The blacklist setting indicates a filtering strategy that rules out a subset:

  • Items are considered to match the server class by default.
  • Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
  • Items that match any whitelist entry are considered to match the server class.

More briefly:

whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable

If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.

machineTypesFilter String Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.

Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included.

Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter.

The patterns are PCRE regular expressions, with the following aids for easier entry:

  • You can specify '.' to mean '\\.'
  • You can specify '*' to mean '.*'
  • Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation String The location on the deployment server to store the content that is to be deployed for this server class.

For example: $SPLUNK_HOME/etc/deployment-apps

restartSplunkWeb Boolean Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.

Defaults to false

restartSplunkd Boolean Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.

Defaults to false

stateOnClient Enum Valid values are (enabled | disabled | noop).
  • enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server.
  • disabled: Sets the application state to disabled on the client, regardless of state on the deployment server.
  • noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation String The location on the deployment client to install the apps defined for this Deployment Server.

If unset, or set to empty, the repositoryLocation path is used. That is, defaults to:

$SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance

Useful only with complex (for example, tiered) deployment strategies.


tmpFolder String Working folder used by deployment server.

Defaults to $SPLUNK_HOME/var/run/tmp

whitelist.* String List of hosts to accept for this server class.

For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.

Response data keys

None

[ Top ]


search/distributed/bundle-replication-files

https://<host>:<mPort>/services/search/distributed/bundle-replication-files

Description

Provide access to distributed search bundle replication files.

Method summary

Method Description Formats
GET List distributed search bundle replication files. XML, JSON

GET search/distributed/bundle-replication-files method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

None

[ Top ]


search/distributed/bundle-replication-files/{name}

https://<host>:<mPort>/services/search/distributed/bundle-replication-files/{name}

Description

Get {name} bundle replication file information.

Method summary

Method Description Formats
GET LIst information about the specified bundle replication file. For {name}, specify the checksum for the file. XML, JSON

GET search/distributed/bundle-replication-files/{name} method detail

Example

Request parameters
Name Type Default Description
force_list_all Boolean Indicates whether to force a listing of the file.
Response data keys

None

[ Top ]


search/distributed/config

https://<host>:<mPort>/services/search/distributed/config

Description

Provides access to the Splunk Enterprise distributed search options. This option is not for adding search peers.

Method summary

Method Description Formats
GET Lists the configuration options for the distributed search system. XML, JSON

GET search/distributed/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
autoAddServers [Deprecated]
blacklistNames List of filenames that match the blacklist pattern, and are not replicated.
blacklistURLs List of URLs that are blacklisted, and thus is not replicated.
checkTimedOutServersFrequency Rechecks servers at the specified frequency (in seconds). If this is set to 0, then no recheck occurs. Defaults to 60.

This attribute is ONLY relevant if removeTimedOutServers is set to true. If removeTimedOutServers is false, this attribute is ignored.

connectionTimeout Connection timeout.
disabled Indicates if the distributed search is disabled.
dist_search_enabled Indicates if the distributed search is enabled.
heartbeatFrequency [Deprecated]
heartbeatMcastAddr [Deprecated]
heartbeatPort [Deprecated]
receiveTimeout Amount of time in seconds to use as a timeout while trying to read/receive data from a search peer.
removedTimedOutServers If true, removes a server connection that cannot be made within serverTimeout.

If false, every call to that server attempts to connect. This may result in a slow user interface.

sendTimeout Send timeout.
serverTimeout [Deprecated] Refer to connectionTimeout, sendTimeout, and receiveTimeout.
servers The initial list of servers.

If operating completely in autoAddServers mode (discovering all servers), there is no need to list any servers here.

shareBundles Indicates whether this server uses bundle replication to share search time configuration with search peers.

If set to false, the search head assumes that the search peers can access the correct bundles using an NFS share and have correctly configured the options listed under: "SEARCH HEAD BUNDLE MOUNTING OPTIONS."

skipOurselves [Deprecated]
statusTimeout Set connection timeout when gathering a search peer's basic info (/services/server/info). Read/write timeouts are automatically set to twice this value.
ttl [Deprecated]

[ Top ]


search/distributed/peers

https://<host>:<mPort>/services/search/distributed/peers

Description

Provides distributed peer server management. A search peer is defined as a splunk server to which another splunk server distributes searches. The splunk server where the search request originates is referred to as the search head.

Method summary

Method Description Formats
GET Returns a list of configured search peers that this search head is configured to distribute searches to. This includes configured search peers disabled. XML, JSON

GET search/distributed/peers method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
build The Splunk Enterprise build number for this peer.
bundle_versions The IDs of the bundles (of this search head) that the peer has.

The IDs are sorted from latest to earliest.

disabled Indicates if the peer is disabled.
guid GUID of the peer.
is_https Inidcates if the management port is ussing SSL.
licenseSignature The license signature.
peerName The Splunk Enterprise server name of the peer.
peerType Specifies whether the peer is configured or discovered.
replicationStatus The status of bundle replication to this peer. Can be any of the following values:
Initial
In progress
Failed
Successful
Mounted
status The status of the peer.

Can be one of the following values:

Up
Down
Blacklisted
Not a Splunk server
Free Splunk server
Authentication Failed
Duplicate License
Duplicate Servername
Inconsistent bundles
version The Splunk Enterprise version string this peer is running.

[ Top ]


search/distributed/peers/{name}

https://<host>:<mPort>/services/search/distributed/peers

Description

Provides distributed peer server management. A search peer is defined as a splunk server to which another splunk server distributes searches. The splunk server where the search request originates is referred to as the search head.

Method summary

Method Description Formats
POST Returns a list of configured search peers that this search head is configured to distribute searches to. This includes configured search peers disabled. XML, JSON

POST search/distributed/peers/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys
Name Description
build The Splunk Enterprise build number for this peer.
bundle_versions The IDs of the bundles (of this search head) that the peer has.

The IDs are sorted from latest to earliest.

disabled Indicates if the peer is disabled.
guid GUID of the peer.
is_https Inidcates if the management port is ussing SSL.
licenseSignature The license signature.
peerName The Splunk Enterprise server name of the peer.
peerType Specifies whether the peer is configured or discovered.
replicationStatus The status of bundle replication to this peer. Can be any of the following values:
Initial
In progress
Failed
Successful
Mounted
status The status of the peer.

Can be one of the following values:

Up
Down
Blacklisted
Not a Splunk server
Free Splunk server
Authentication Failed
Duplicate License
Duplicate Servername
Inconsistent bundles
version The Splunk Enterprise version string this peer is running.

[ Top ]

PREVIOUS
Configuration endpoint examples
  NEXT
Deployment endpoint examples

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters