Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Introspection endpoint examples

data/index-volumes GET

XML
XML Request
curl -k -u admin:passwd https://localhost:8089/services/data/index-volumes
XML Response
.
.
.
 <title>introspection--disk-objects--volumes</title>
 <id>https://localhost:8089/services/data/index-volumes</id>
 <updated>2014-03-25T14:41:09-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>_splunk_summaries</title>
   <id>https://localhost:8089/services/data/index-volumes/_splunk_summaries</id>
   <updated>2014-03-25T14:41:09-07:00</updated>
   <link href="/services/data/index-volumes/_splunk_summaries" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/data/index-volumes/_splunk_summaries" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="max_size">infinite</s:key>
       <s:key name="name">_splunk_summaries</s:key>
     </s:dict>
   </content>
 </entry>

data/index-volumes/{name} GET

XML
XML Request
curl -k -u admin:passwd https://localhost:8089/services/data/index-volumes/_splunk_summaries
XML Response
.
.
.
 <title>introspection--disk-objects--volumes</title>
 <id>https://localhost:8089/services/data/index-volumes</id>
 <updated>2014-03-27T14:35:26-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>_splunk_summaries</title>
   <id>https://localhost:8089/services/data/index-volumes/_splunk_summaries</id>
   <updated>2014-03-27T14:35:26-07:00</updated>
   <link href="/services/data/index-volumes/_splunk_summaries" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/data/index-volumes/_splunk_summaries" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="eai:attributes">... elided ...</s:key>
       <s:key name="max_size">infinite</s:key>
       <s:key name="name">_splunk_summaries</s:key>
     </s:dict>
   </content>
 </entry>

data/indexes GET

XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/data/indexes


XML Response
.
.
.
 <title>indexes</title>
 <id>https://localhost:8089/services/data/indexes</id>
 <updated>2011-07-11T18:09:22-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/indexes/_new" rel="create"/>
 <link href="/services/data/indexes/_reload" rel="_reload"/>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>_audit</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/indexes/_audit</id>
   <updated>2011-07-11T18:09:22-07:00</updated>
   <link href="/servicesNS/nobody/system/data/indexes/_audit" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/indexes/_audit" rel="list"/>
   <link href="/servicesNS/nobody/system/data/indexes/_audit/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/indexes/_audit" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/indexes/_audit/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="assureUTF8">0</s:key>
       <s:key name="blockSignSize">0</s:key>
       <s:key name="blockSignatureDatabase">_blocksignature</s:key>
       <s:key name="coldPath">$SPLUNK_DB/audit/colddb</s:key>
       <s:key name="coldPath_expanded">/home/amrit/temp/curl/splunk/var/lib/splunk/audit/colddb</s:key>
       <s:key name="coldToFrozenDir"/>
       <s:key name="coldToFrozenScript"/>
       <s:key name="compressRawdata">1</s:key>
       <s:key name="currentDBSizeMB">1</s:key>
       <s:key name="defaultDatabase">main</s:key>
       <s:key name="disabled">0</s:key>
          ... eai:acl element elided ...
       <s:key name="enableRealtimeSearch">1</s:key>
       <s:key name="frozenTimePeriodInSecs">188697600</s:key>
       <s:key name="homePath">$SPLUNK_DB/audit/db</s:key>
       <s:key name="homePath_expanded">/home/amrit/temp/curl/splunk/var/lib/splunk/audit/db</s:key>
       <s:key name="indexThreads">auto</s:key>
       <s:key name="isInternal">1</s:key>
       <s:key name="lastInitTime">1310432962.424512</s:key>
       <s:key name="maxConcurrentOptimizes">3</s:key>
       <s:key name="maxDataSize">auto</s:key>
       <s:key name="maxHotBuckets">3</s:key>
       <s:key name="maxHotIdleSecs">0</s:key>
       <s:key name="maxHotSpanSecs">7776000</s:key>
       <s:key name="maxMemMB">5</s:key>
       <s:key name="maxMetaEntries">1000000</s:key>
       <s:key name="maxRunningProcessGroups">20</s:key>
       <s:key name="maxTime">2011-07-10T22:20:53-0700</s:key>
       <s:key name="maxTotalDataSizeMB">500000</s:key>
       <s:key name="maxWarmDBCount">300</s:key>
       <s:key name="memPoolMB">auto</s:key>
       <s:key name="minRawFileSyncSecs">disable</s:key>
       <s:key name="minTime">2011-07-10T14:33:00-0700</s:key>
       <s:key name="partialServiceMetaPeriod">0</s:key>
       <s:key name="quarantineFutureSecs">2592000</s:key>
       <s:key name="quarantinePastSecs">77760000</s:key>
       <s:key name="rawChunkSizeBytes">131072</s:key>
       <s:key name="rotatePeriodInSecs">60</s:key>
       <s:key name="serviceMetaPeriod">25</s:key>
       <s:key name="suppressBannerList"/>
       <s:key name="sync">0</s:key>
       <s:key name="syncMeta">1</s:key>
       <s:key name="thawedPath">$SPLUNK_DB/audit/thaweddb</s:key>
       <s:key name="thawedPath_expanded">/home/amrit/temp/curl/splunk/var/lib/splunk/audit/thaweddb</s:key>
       <s:key name="throttleCheckPeriod">15</s:key>
       <s:key name="totalEventCount">230</s:key>
     </s:dict>
   </content>
 </entry>

data/indexes POST

XML
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/data/indexes -d name=Shadow


XML Response
.
.
.
 <title>indexes</title>
 <id>https://localhost:8089/servicesNS/admin/search/data/indexes</id>
 <updated>2011-05-13T13:09:27-07:00</updated>
 <generator version="98392"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/servicesNS/admin/search/data/indexes/_new" rel="create"/>
 <link href="/servicesNS/admin/search/data/indexes/_reload" rel="_reload"/>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>shadow</title>
   <id>https://localhost:8089/servicesNS/nobody/search/data/indexes/shadow</id>
   <updated>2011-05-13T13:09:27-07:00</updated>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="list"/>
   <link href="/servicesNS/nobody/search/data/indexes/shadow/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="assureUTF8">0</s:key>
       <s:key name="blockSignSize">0</s:key>
       <s:key name="blockSignatureDatabase">_blocksignature</s:key>
       <s:key name="coldPath">$SPLUNK_DB/shadow/colddb</s:key>
       <s:key name="coldPath_expanded">/Applications/splunk/var/lib/splunk/shadow/colddb</s:key>
       <s:key name="coldToFrozenDir"></s:key>
       <s:key name="coldToFrozenScript"></s:key>
       <s:key name="compressRawdata">1</s:key>
       <s:key name="currentDBSizeMB">1</s:key>
       <s:key name="defaultDatabase">main</s:key>
       <s:key name="eai:acl">. . .</s:key>
       <s:key name="enableRealtimeSearch">1</s:key>
       <s:key name="frozenTimePeriodInSecs">188697600</s:key>
       <s:key name="homePath">$SPLUNK_DB/shadow/db</s:key>
       <s:key name="homePath_expanded">/Applications/splunk/var/lib/splunk/shadow/db</s:key>
       <s:key name="indexThreads">auto</s:key>
       <s:key name="isInternal">0</s:key>
       <s:key name="lastInitTime">1305317367.331268</s:key>
       <s:key name="maxConcurrentOptimizes">3</s:key>
       <s:key name="maxDataSize">auto</s:key>
       <s:key name="maxHotBuckets">3</s:key>
       <s:key name="maxHotIdleSecs">0</s:key>
       <s:key name="maxHotSpanSecs">7776000</s:key>
       <s:key name="maxMemMB">5</s:key>
       <s:key name="maxMetaEntries">1000000</s:key>
       <s:key name="maxTime"></s:key>
       <s:key name="maxTotalDataSizeMB">500000</s:key>
       <s:key name="maxWarmDBCount">300</s:key>
       <s:key name="memPoolMB">auto</s:key>
       <s:key name="minRawFileSyncSecs">disable</s:key>
       <s:key name="minTime"></s:key>
       <s:key name="partialServiceMetaPeriod">0</s:key>
       <s:key name="quarantineFutureSecs">2592000</s:key>
       <s:key name="quarantinePastSecs">77760000</s:key>
       <s:key name="rawChunkSizeBytes">131072</s:key>
       <s:key name="rotatePeriodInSecs">60</s:key>
       <s:key name="serviceMetaPeriod">25</s:key>
       <s:key name="suppressBannerList"></s:key>
       <s:key name="sync">0</s:key>
       <s:key name="syncMeta">1</s:key>
       <s:key name="thawedPath">$SPLUNK_DB/shadow/thaweddb</s:key>
       <s:key name="thawedPath_expanded">/Applications/splunk/var/lib/splunk/shadow/thaweddb</s:key>
       <s:key name="throttleCheckPeriod">15</s:key>
       <s:key name="totalEventCount">0</s:key>
     </s:dict>
   </content>
 </entry>

data/indexes/{name} DELETE

XML
XML Request
curl -k -u admin:pass --request DELETE https://localhost:8089/services/data/indexes/shadow


XML Response
.
.
.
 <title>indexes</title>
 <id>https://localhost:8089/services/data/indexes</id>
 <updated>2012-08-02T11:10:16-07:00</updated>
 <generator build="131547" version="5.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/indexes/_new" rel="create"/>
 <link href="/services/data/indexes/_reload" rel="_reload"/>
    ... opensearch elements elided ...
 <s:messages/>

data/indexes/{name} GET

XML
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/data/indexes/shadow


XML Response
.
.
.
 <title>indexes</title>
 <id>https://localhost:8089/servicesNS/nobody/search/data/indexes</id>
 <updated>2011-08-01T12:25:34-07:00</updated>
 <generator version="105103"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/servicesNS/nobody/search/data/indexes/_new" rel="create"/>
 <link href="/servicesNS/nobody/search/data/indexes/_reload" rel="_reload"/>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>shadow</title>
   <id>https://localhost:8089/servicesNS/nobody/search/data/indexes/shadow</id>
   <updated>2011-08-01T11:47:55-07:00</updated>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="list"/>
   <link href="/servicesNS/nobody/search/data/indexes/shadow/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="edit"/>
   <link href="/servicesNS/nobody/search/data/indexes/shadow/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="assureUTF8">0</s:key>
       <s:key name="blockSignSize">0</s:key>
       <s:key name="blockSignatureDatabase">_blocksignature</s:key>
       <s:key name="bloomfilterTotalSizeKB">0</s:key>
       <s:key name="coldPath">$SPLUNK_DB/shadow/colddb</s:key>
       <s:key name="coldPath_expanded">/home/amrit/bin/splunk-current/var/lib/splunk/shadow/colddb</s:key>
       <s:key name="coldToFrozenDir"/>
       <s:key name="coldToFrozenScript"/>
       <s:key name="compressRawdata">1</s:key>
       <s:key name="currentDBSizeMB">1</s:key>
       <s:key name="defaultDatabase">main</s:key>
       <s:key name="disabled">0</s:key>
          ...eai:acl element elided ...
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list>
               <s:item>assureUTF8</s:item>
               <s:item>blockSignSize</s:item>
               <s:item>coldToFrozenDir</s:item>
               <s:item>coldToFrozenScript</s:item>
               <s:item>compressRawdata</s:item>
               <s:item>frozenTimePeriodInSecs</s:item>
               <s:item>maxConcurrentOptimizes</s:item>
               <s:item>maxDataSize</s:item>
               <s:item>maxHotBuckets</s:item>
               <s:item>maxHotIdleSecs</s:item>
               <s:item>maxHotSpanSecs</s:item>
               <s:item>maxMemMB</s:item>
               <s:item>maxMetaEntries</s:item>
               <s:item>maxRunningProcessGroups</s:item>
               <s:item>maxTotalDataSizeMB</s:item>
               <s:item>maxWarmDBCount</s:item>
               <s:item>minRawFileSyncSecs</s:item>
               <s:item>partialServiceMetaPeriod</s:item>
               <s:item>quarantineFutureSecs</s:item>
               <s:item>quarantinePastSecs</s:item>
               <s:item>rawChunkSizeBytes</s:item>
               <s:item>rotatePeriodInSecs</s:item>
               <s:item>serviceMetaPeriod</s:item>
               <s:item>suppressBannerList</s:item>
               <s:item>syncMeta</s:item>
               <s:item>throttleCheckPeriod</s:item>
             </s:list>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="enableRealtimeSearch">1</s:key>
       <s:key name="frozenTimePeriodInSecs">188697600</s:key>
       <s:key name="homePath">$SPLUNK_DB/shadow/db</s:key>
       <s:key name="homePath_expanded">/home/amrit/bin/splunk-current/var/lib/splunk/shadow/db</s:key>
       <s:key name="indexThreads">auto</s:key>
       <s:key name="isInternal">0</s:key>
       <s:key name="lastInitTime">1312226552.102920</s:key>
       <s:key name="maxConcurrentOptimizes">3</s:key>
       <s:key name="maxDataSize">auto</s:key>
       <s:key name="maxHotBuckets">3</s:key>
       <s:key name="maxHotIdleSecs">0</s:key>
       <s:key name="maxHotSpanSecs">7776000</s:key>
       <s:key name="maxMemMB">5</s:key>
       <s:key name="maxMetaEntries">1000000</s:key>
       <s:key name="maxRunningProcessGroups">20</s:key>
       <s:key name="maxTime"/>
       <s:key name="maxTotalDataSizeMB">500000</s:key>
       <s:key name="maxWarmDBCount">300</s:key>
       <s:key name="memPoolMB">auto</s:key>
       <s:key name="minRawFileSyncSecs">disable</s:key>
       <s:key name="minTime"/>
       <s:key name="numBloomfilters">0</s:key>
       <s:key name="numHotBuckets">0</s:key>
       <s:key name="numWarmBuckets">0</s:key>
       <s:key name="partialServiceMetaPeriod">0</s:key>
       <s:key name="quarantineFutureSecs">2592000</s:key>
       <s:key name="quarantinePastSecs">77760000</s:key>
       <s:key name="rawChunkSizeBytes">131072</s:key>
       <s:key name="rotatePeriodInSecs">60</s:key>
       <s:key name="serviceMetaPeriod">25</s:key>
       <s:key name="suppressBannerList"/>
       <s:key name="sync">0</s:key>
       <s:key name="syncMeta">1</s:key>
       <s:key name="thawedPath">$SPLUNK_DB/shadow/thaweddb</s:key>
       <s:key name="thawedPath_expanded">/home/amrit/bin/splunk-current/var/lib/splunk/shadow/thaweddb</s:key>
       <s:key name="throttleCheckPeriod">15</s:key>
       <s:key name="totalEventCount">0</s:key>
     </s:dict>
   </content>
 </entry>

data/indexes/{name} POST

XML
XML Request
curl -k -u admin:pass -d maxTotalDataSizeMB=400000 https://localhost:8089/servicesNS/nobody/search/data/indexes/shadow


XML Response
.
.
.
 <title>indexes</title>
 <id>https://localhost:8089/servicesNS/nobody/search/data/indexes</id>
 <updated>2011-05-16T12:20:06-07:00</updated>
 <generator version="98392"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/servicesNS/nobody/search/data/indexes/_new" rel="create"/>
 <link href="/servicesNS/nobody/search/data/indexes/_reload" rel="_reload"/>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>shadow</title>
   <id>https://localhost:8089/servicesNS/nobody/search/data/indexes/shadow</id>
   <updated>2011-05-16T12:18:56-07:00</updated>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="list"/>
   <link href="/servicesNS/nobody/search/data/indexes/shadow/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/search/data/indexes/shadow" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="assureUTF8">0</s:key>
       <s:key name="blockSignSize">0</s:key>
       <s:key name="blockSignatureDatabase">_blocksignature</s:key>
       <s:key name="coldPath">$SPLUNK_DB/shadow/colddb</s:key>
       <s:key name="coldPath_expanded">/Applications/splunk4.3/var/lib/splunk/shadow/colddb</s:key>
       <s:key name="coldToFrozenDir"></s:key>
       <s:key name="coldToFrozenScript"></s:key>
       <s:key name="compressRawdata">1</s:key>
       <s:key name="currentDBSizeMB">1</s:key>
       <s:key name="defaultDatabase">main</s:key>
       <s:key name="eai:acl">. . .</s:key>
       <s:key name="enableRealtimeSearch">1</s:key>
       <s:key name="frozenTimePeriodInSecs">188697600</s:key>
       <s:key name="homePath">$SPLUNK_DB/shadow/db</s:key>
       <s:key name="homePath_expanded">/Applications/splunk4.3/var/lib/splunk/shadow/db</s:key>
       <s:key name="indexThreads">auto</s:key>
       <s:key name="isInternal">0</s:key>
       <s:key name="lastInitTime">1305573611.118477</s:key>
       <s:key name="maxConcurrentOptimizes">3</s:key>
       <s:key name="maxDataSize">auto</s:key>
       <s:key name="maxHotBuckets">3</s:key>
       <s:key name="maxHotIdleSecs">0</s:key>
       <s:key name="maxHotSpanSecs">7776000</s:key>
       <s:key name="maxMemMB">5</s:key>
       <s:key name="maxMetaEntries">1000000</s:key>
       <s:key name="maxTime"></s:key>
       <s:key name="maxTotalDataSizeMB">400000</s:key>
       <s:key name="maxWarmDBCount">300</s:key>
       <s:key name="memPoolMB">auto</s:key>
       <s:key name="minRawFileSyncSecs">disable</s:key>
       <s:key name="minTime"></s:key>
       <s:key name="partialServiceMetaPeriod">0</s:key>
       <s:key name="quarantineFutureSecs">2592000</s:key>
       <s:key name="quarantinePastSecs">77760000</s:key>
       <s:key name="rawChunkSizeBytes">131072</s:key>
       <s:key name="rotatePeriodInSecs">60</s:key>
       <s:key name="serviceMetaPeriod">25</s:key>
       <s:key name="suppressBannerList"></s:key>
       <s:key name="sync">0</s:key>
       <s:key name="syncMeta">1</s:key>
       <s:key name="thawedPath">$SPLUNK_DB/shadow/thaweddb</s:key>
       <s:key name="thawedPath_expanded">/Applications/splunk4.3/var/lib/splunk/shadow/thaweddb</s:key>
       <s:key name="throttleCheckPeriod">15</s:key>
       <s:key name="totalEventCount">0</s:key>
     </s:dict>
   </content>
 </entry>

data/indexes-extended GET

XML
XML Request
curl -k -u admin:passwd https://localhost:8089/services/data/indexes-extended


XML Response
.
.
.
 <title>introspection--disk-objects--indexes</title>
 <id>https://localhost:8089/services/data/indexes-extended</id>
 <updated>2014-03-31T12:41:09-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
   ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>_audit</title>
   <id>https://localhost:8089/services/data/indexes-extended/_audit</id>
   <updated>2014-03-31T12:41:09-07:00</updated>
   <link href="/services/data/indexes-extended/_audit" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/data/indexes-extended/_audit" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="bucket_dirs">
         <s:dict>
           <s:key name="cold">
             <s:dict>
               <s:key name="bucket_count">0</s:key>
               <s:key name="size">0.000</s:key>
             </s:dict>
           </s:key>
           <s:key name="home">
             <s:dict>
               <s:key name="event_count">6169</s:key>
               <s:key name="event_max_time">1395246673</s:key>
               <s:key name="event_min_time">1394732683</s:key>
               <s:key name="hot_bucket_count">1</s:key>
               <s:key name="size">1.000</s:key>
               <s:key name="warm_bucket_count">5</s:key>
             </s:dict>
           </s:key>
           <s:key name="thawed">
             <s:dict>
               <s:key name="bucket_count">0</s:key>
               <s:key name="size">0.000</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="name">_audit</s:key>
       <s:key name="total_bucket_count">6</s:key>
       <s:key name="total_event_count">18096</s:key>
       <s:key name="total_raw_size">1.000</s:key>
       <s:key name="total_size">1.000</s:key>
     </s:dict>
   </content>
 </entry>
     .
     .
     .
   elided
     .
     .
     .
 <entry>
   <title>summary</title>
   <id>https://localhost:8089/services/data/indexes-extended/summary</id>
   <updated>2014-03-31T12:41:09-07:00</updated>
   <link href="/services/data/indexes-extended/summary" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/data/indexes-extended/summary" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="name">summary</s:key>
       <s:key name="total_size">0.000</s:key>
     </s:dict>
   </content>
 </entry>

data/indexes-extended/{name} GET

XML
XML Request
curl -k -u admin:passwd https://localhost:8089/services/data/indexes-extended/history


XML Response
.
.
.
 <title>introspection--disk-objects--indexes</title>
 <id>https://localhost:8089/services/data/indexes-extended</id>
 <updated>2014-03-31T12:42:29-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
   ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>_internal</title>
   <id>https://localhost:8089/services/data/indexes-extended/_internal</id>
   <updated>2014-03-31T12:42:29-07:00</updated>
   <link href="/services/data/indexes-extended/_internal" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/data/indexes-extended/_internal" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="bucket_dirs">
         <s:dict>
           <s:key name="cold">
             <s:dict>
               <s:key name="bucket_count">0</s:key>
               <s:key name="size">0.000</s:key>
             </s:dict>
           </s:key>
           <s:key name="home">
             <s:dict>
               <s:key name="event_count">180492</s:key>
               <s:key name="event_max_time">1395246673</s:key>
               <s:key name="event_min_time">1392167582</s:key>
               <s:key name="hot_bucket_count">3</s:key>
               <s:key name="size">9.000</s:key>
               <s:key name="warm_bucket_count">6</s:key>
             </s:dict>
           </s:key>
           <s:key name="thawed">
             <s:dict>
               <s:key name="bucket_count">0</s:key>
               <s:key name="size">0.000</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="eai:attributes">
         ... elided ...
       </s:key>
       <s:key name="name">_internal</s:key>
       <s:key name="total_bucket_count">9</s:key>
       <s:key name="total_event_count">556322</s:key>
       <s:key name="total_raw_size">28.000</s:key>
       <s:key name="total_size">22.000</s:key>
     </s:dict>
   </content>
 </entry>

server/info GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/info


XML Response
.
.
.
 <title>server-info</title>
 <id>https://localhost:8089/services/server/info</id>
 <updated>2014-08-04T15:48:10-07:00</updated>
 <generator build="221120" version="6.2"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>server-info</title>
   <id>https://localhost:8089/services/server/info/server-info</id>
   <updated>2014-08-04T15:48:10-07:00</updated>
   <link href="/services/server/info/server-info" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/info/server-info" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="activeLicenseGroup">Enterprise</s:key>
       <s:key name="addOns">
         <s:dict>
           <s:key name="hadoop">
             <s:dict>
               <s:key name="parameters">
                 <s:dict>
                   <s:key name="erp_type">report</s:key>
                   <s:key name="maxNodes">10</s:key>
                 </s:dict>
               </s:key>
               <s:key name="type">external_results_provider</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="build">221120</s:key>
       <s:key name="cpu_arch">x64</s:key>
       <s:key name="eai:acl"> ... elided ... </s:key>
       <s:key name="guid">9CBD8473-4E7D-4FF2-A042-050C5C27C298</s:key>
       <s:key name="host">myHostName</s:key>
       <s:key name="host_fqdn">myHostName</s:key>
       <s:key name="isFree">0</s:key>
       <s:key name="isTrial">0</s:key>
       <s:key name="kv_store_status">Could not find task executor for type 'kv_store_status'</s:key>
       <s:key name="licenseKeys">
         <s:list>
           <s:item>31BB75AA379A50F9225471053337B6E438C4C7A1F42A905AB93AF16C9A12124E</s:item>
         </s:list>
       </s:key>
       <s:key name="licenseSignature">2f121cff440e115470154cdf92e208b5</s:key>
       <s:key name="licenseState">OK</s:key>
       <s:key name="license_labels">
         <s:list>
           <s:item>Splunk xyz License</s:item>
         </s:list>
       </s:key>
       <s:key name="master_guid">9CBD8473-4E7D-4FF2-A042-050C5C27C298</s:key>
       <s:key name="max_users">4294967295</s:key>
       <s:key name="mode">normal</s:key>
       <s:key name="numberOfCores">2</s:key>
       <s:key name="os_build">6</s:key>
       <s:key name="os_name">Windows</s:key>
       <s:key name="os_version">1</s:key>
       <s:key name="physicalMemoryMB">3982</s:key>
       <s:key name="product_type">splunk</s:key>
       <s:key name="rtsearch_enabled">1</s:key>
       <s:key name="serverName">myHostName</s:key>
       <s:key name="server_roles">
         <s:dict>
           <s:key name="indexer"/>
           <s:key name="license_master"/>
           <s:key name="management_console"/>
         </s:dict>
       </s:key>
       <s:key name="startup_time">1407182814</s:key>
       <s:key name="version">6.2</s:key>
     </s:dict>
   </content>
 </entry>

server/introspection GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/introspection


XML Response
.
.
.
 <title></title>
 <id>https://localhost:8089/services/server/introspection</id>
 <updated>2014-08-04T11:40:23-07:00</updated>
 <generator build="221120" version="6.2"/>
 <author>
   <name>Splunk</name>
 </author>
 <s:messages/>
 <entry>
   <title>indexer</title>
   <id>https://localhost:8089/services/server/introspection/indexer</id>
   <updated>2014-08-04T11:40:23-07:00</updated>
   <link href="/services/server/introspection/indexer" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/indexer" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>kvstore</title>
   <id>https://localhost:8089/services/server/introspection/kvstore</id>
   <updated>2014-08-04T11:40:23-07:00</updated>
   <link href="/services/server/introspection/kvstore" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/kvstore" rel="list"/>
   <link href="/services/server/introspection/kvstore/_reload" rel="_reload"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>pipelines</title>
   <id>https://localhost:8089/services/server/introspection/pipelines</id>
   <updated>2014-08-04T11:40:23-07:00</updated>
   <link href="/services/server/introspection/pipelines" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/pipelines" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>processors</title>
   <id>https://localhost:8089/services/server/introspection/processors</id>
   <updated>2014-08-04T11:40:23-07:00</updated>
   <link href="/services/server/introspection/processors" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/processors" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>queues</title>
   <id>https://localhost:8089/services/server/introspection/queues</id>
   <updated>2014-08-04T11:40:23-07:00</updated>
   <link href="/services/server/introspection/queues" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/queues" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>

server/introspection/indexer GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/introspection/indexer


XML Response
.
.
.
 <title>introspection-indexer</title>
 <id>https://localhost:8089/services/server/introspection/indexer</id>
 <updated>2014-08-04T11:43:04-07:00</updated>
 <generator build="221120" version="6.2"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>indexer</title>
   <id>https://localhost:8089/services/server/introspection/indexer/indexer</id>
   <updated>2014-08-04T11:43:04-07:00</updated>
   <link href="/services/server/introspection/indexer/indexer" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/indexer/indexer" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="average_KBps">0.517667</s:key>
       <s:key name="eai:acl">... elided ...</s:key>
       <s:key name="reason">.</s:key>
       <s:key name="status">nominal</s:key>
     </s:dict>
   </content>
 </entry>

server/introspection/kvstore GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/introspection/kvstore


XML Response
.
.
.
 <title></title>
 <id>https://localhost:8089/services/server/introspection/kvstore</id>
 <updated>2014-08-20T14:06:12-07:00</updated>
 <generator build="221120" version="6.2"/>
 <author>
   <name>Splunk</name>
 </author>
 <s:messages/>
 <entry>
   <title>collectionstats</title>
   <id>https://localhost:8089/services/server/introspection/kvstore/collectionstats</id>
   <updated>2014-08-20T14:06:12-07:00</updated>
   <link href="/services/server/introspection/kvstore/collectionstats" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/kvstore/collectionstats" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>replicasetstats</title>
   <id>https://localhost:8089/services/server/introspection/kvstore/replicasetstats</id>
   <updated>2014-08-20T14:06:12-07:00</updated>
   <link href="/services/server/introspection/kvstore/replicasetstats" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/kvstore/replicasetstats" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>serverstatus</title>
   <id>https://localhost:8089/services/server/introspection/kvstore/serverstatus</id>
   <updated>2014-08-20T14:06:12-07:00</updated>
   <link href="/services/server/introspection/kvstore/serverstatus" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/introspection/kvstore/serverstatus" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>

server/introspection/kvstore/collectionstats GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/introspection/kvstore/collectionstats


XML Response
.
.
.
<title>kvstore-collectionstats</title> <id>https://localhost:8089/services/server/introspection/kvstore/collectionstats</id> <updated>2014-08-20T14:31:42-07:00</updated> <generator build="226873" version="6.2"/> <author>

 <name>Splunk</name>
</author> ... opensearch nodes elided ... <s:messages/> <entry>

 <title>collectionStats</title>
 <id>https://localhost:8089/services/server/introspection/kvstore/collectionstats/collectionStats</id>
 <updated>2014-08-20T14:31:42-07:00</updated>
 <link href="/services/server/introspection/kvstore/collectionstats/collectionStats" rel="alternate"/>
 <author>
   <name>system</name>
 </author>
 <link href="/services/server/introspection/kvstore/collectionstats/collectionStats" rel="list"/>
 <content type="text/xml">
   <s:dict>
     <s:key name="data">
       <s:list>
         <s:item>
         {"ns":"search.kvstoredemo",
          "count":0,
          "size":0,
          "storageSize":8192,
          "numExtents":1,
          "nindexes":2,
          "lastExtentSize":8192,
          "paddingFactor":1,
          "systemFlags":1,
          "userFlags":1,
          "totalIndexSize":16352,
          "indexSizes":{"_id_":8176,"_UserAndKeyUniqueIndex":8176},
          "ok":1}
         </s:item>
       </s:list>
     </s:key>
     <s:key name="eai:acl"> ... elided ...</s:key>
   </s:dict>
 </content>
</entry>

server/introspection/kvstore/replicasetstats GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/introspection/kvstore/replicasetstats


XML Response
.
.
.
<title>kvstore-collectionstats</title> <id>https://localhost:8089/services/server/introspection/kvstore/collectionstats</id> <updated>2014-08-20T14:31:42-07:00</updated> <generator build="226873" version="6.2"/> <author>

<name>Splunk</name>
</author>

   ... opensearch nodes elided ... <s:messages/>
<entry>

<title>replicasetstats</title>
<id>https://localhost:8089/services/server/introspection/kvstore/replicasetstats/replicasetstats</id>
<updated>2014-08-20T14:31:42-07:00</updated>
<link href="/services/server/introspection/kvstore/replicasetstats/replicasetstats" rel="alternate"/>
<author>
  <name>system</name>
</author>
<link href="/services/server/introspection/kvstore/replicasetstats/replicasetstats" rel="list"/>
<content type="text/xml">
  <s:dict>
    <s:key name="data">
      <s:list>
        <s:item>
           {
             "replSetStats": {
               "set": "splunkrs",
               "date": 1412203576000, 
               "myState": 2,
               "syncingTo": "54.xxx.xxx.xxx:8191",
               "members": [
                 {
                   "_id": 2,
                   "name": "54.xxx.xxx.xxx:8191",
                   "health": 1,
                   "state": 2,
                   "stateStr": "SECONDARY",
                   "uptime": 102409,
                   "optime": {
                     "t": 1412101153,
                     "i": 1
                   },
                   "optimeDate": 1412101153000,
                   "lastHeartbeat": 1412203575000,
                   "lastHeartbeatRecv": 1412203575000,
                   "pingMs": 1,
                   "syncingTo": "54.xxx.xxx.xxx:8191"
                 },
                 {
                   "_id": 3,
                   "name": "54.xxx.xxx.yyy:8191",
                   "health": 1,
                   "state": 2,
                   "stateStr": "SECONDARY",
                   "uptime": 102409,
                   "optime": {
                     "t": 1412101153,
                     "i": 1
                   },
                   "optimeDate": 1412101153000,
                   "lastHeartbeat": 1412203576000,
                   "lastHeartbeatRecv": 1412203575000,
                   "pingMs": 1,
                   "syncingTo": "54.xxx.xxx.yyy:8191"
                 },
                         .
                         .
                         .
                       elided
                         .
                         .
                         .
                 {
                   "_id": 17,
                   "name": "54.xxx.xxx.zzz:8191",
                   "health": 1,
                   "state": 2,
                   "stateStr": "SECONDARY",
                   "uptime": 102409,
                   "optime": {
                     "t": 1412101153,
                     "i": 1
                   },
                   "optimeDate": 1412101153000,
                   "lastHeartbeat": 1412203574000,
                   "lastHeartbeatRecv": 1412203575000,
                   "pingMs": 1,
                   "syncingTo": "54.xxx.xxx.zzz:8191"
                 }
               ],
               "ok": 1
             },
             "oplogInfo": {
               "start": 1412022009000,
               "end": 1412101153000,
               "collectionStats": {
                 "ns": "local.oplog.rs",
                 "count": 631,
                 "size": 166964,
                 "avgObjSize": 264,
                 "storageSize": 1048580080,
                 "numExtents": 3,
                 "nindexes": 0,
                 "lastExtentSize": 4096,
                 "paddingFactor": 1,
                 "systemFlags": 0,
                 "userFlags": 0,
                 "totalIndexSize": 0,
                 "indexSizes": {},
                 "capped": true,
                 "max": 9223372036854775808.000000,
                 "ok": 1
               },
               "sources": {}
             }
           }
       </s:item>
      </s:list>
    </s:key>
    <s:key name="eai:acl"> ... elided ...</s:key>
  </s:dict>
</content>
</entry> 

server/introspection/kvstore/serverstatus GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/introspection/kvstore/serverstatus


XML Response
.
.
.
<title>kvstore-serverstatus</title> <id>https://localhost:8089/services/server/introspection/kvstore/serverstatus</id> <updated>2014-08-20T14:26:42-07:00</updated> <generator build="226873" version="6.2"/> <author>

 <name>Splunk</name>
</author> ... opensearch nodes elided ... <s:messages/> <entry>

 <title>serverStatus</title>
 <id>https://localhost:8089/services/server/introspection/kvstore/serverstatus/serverStatus</id>
 <updated>2014-08-20T14:26:42-07:00</updated>
 <link href="/services/server/introspection/kvstore/serverstatus/serverStatus" rel="alternate"/>
 <author>
   <name>system</name>
 </author>
 <link href="/services/server/introspection/kvstore/serverstatus/serverStatus" rel="list"/>
 <content type="text/xml">
   <s:dict>
     <s:key name="data">
       <![CDATA[{
"host":"localhost:8089", "version":"2.6.3", "pid":23009, "uptime":19049, "uptimeMillis":19049447, "uptimeEstimate":18295, "localTime":{"$date":1408570002615}, "asserts":{ "regular":0, "warning":0, "msg":0, "user":0, "rollovers":0}, "backgroundFlushing":{ "flushes":317, "total_ms":11523, "average_ms":36.350158, "last_ms":0, "last_finished":{"$date":1408569973325}}, "connections":{ "current":7, "available":3269, "totalCreated":7}, "cursors":{ "note":"deprecated, use server status metrics", "clientCursors_size":0, "totalOpen":0, "pinned":0, "totalNoTimeout":0, "timedOut":0}, "dur":{ "commits":30, "journaledMB":0, "writeToDataFilesMB":0, "compression":0, "commitsInWriteLock":0, "earlyCommits":0, "timeMs":{ "dt":3072, "prepLogBuffer":0, "writeToJournal":0, "writeToDataFiles":0, "remapPrivateView":0}}, "extra_info":{ "note":"fields vary by platform", "heap_usage_bytes":67624592, "page_faults":3}, "globalLock":{ "totalTime":19049447000, "lockTime":1491098, "currentQueue":{ "total":0, "readers":0, "writers":0}, "activeClients":{ "total":0, "readers":0, "writers":0}}, "indexCounters":{ "accesses":2, "hits":2, "misses":0, "resets":0, "missRatio":0}, "locks":{ ".":{ "timeLockedMicros":{ "R":2926340, "W":1491098}, "timeAcquiringMicros":{ "R":1458997, "W":342703}}, "admin":{ "timeLockedMicros":{ "r":103638, "w":0}, "timeAcquiringMicros":{ "r":13202, "w":0}}, "local":{ "timeLockedMicros":{ "r":426518, "w":237}, "timeAcquiringMicros":{ "r":185505, "w":12}}, "search.kvstoredemo":{ "timeLockedMicros":{ "r":2832888, "w":292}, "timeAcquiringMicros":{ "r":1310820, "w":17}}}, "network":{ "bytesIn":1133611, "bytesOut":11628162, "numRequests":12070}, "opcounters":{ "insert":1, "query":4760, "update":0, "delete":0, "getmore":0, "command":8264}, "opcountersRepl":{ "insert":0, "query":0, "update":0, "delete":0, "getmore":0, "command":0}, "recordStats":{ "accessesNotInMemory":0, "pageFaultExceptionsThrown":0, "admin":{ "accessesNotInMemory":0, "pageFaultExceptionsThrown":0}, "local":{ "accessesNotInMemory":0, "pageFaultExceptionsThrown":0}, "search.kvstoredemo":{ "accessesNotInMemory":0, "pageFaultExceptionsThrown":0}}, "writeBacksQueued":false, "mem":{ "bits":64, "resident":58, "virtual":325, "supported":true, "mapped":64, "mappedWithJournal":128}, "metrics":{ "cursor":{ "timedOut":0, "open":{ "noTimeout":0, "pinned":0, "total":0}}, "document":{ "deleted":0, "inserted":1, "returned":2, "updated":0}, "getLastError":{ "wtime":{ "num":0, "totalMillis":0}, "wtimeouts":0}, "operation":{ "fastmod":0, "idhack":0, "scanAndOrder":0}, "queryExecutor":{ "scanned":0, "scannedObjects":0}, "record":{"moves":0}, "repl":{ "apply":{ "batches":{ "num":0, "totalMillis":0}, "ops":0}, "buffer":{ "count":0, "maxSizeBytes":268435456, "sizeBytes":0}, "network":{ "bytes":0, "getmores":{ "num":0, "totalMillis":0}, "ops":0, "readersCreated":0}, "preload":{ "docs":{ "num":0, "totalMillis":0}, "indexes":{ "num":0, "totalMillis":0}}}, "storage":{ "freelist":{ "search":{ "bucketExhausted":0, "requests":0, "scanned":0}}}, "ttl":{ "deletedDocuments":0, "passes":317}}, "ok":1}]]>

     </s:key>
     <s:key name="eai:acl"> ... elided ... </s:key>
   </s:dict>
 </content>
</entry>

server/status GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status


XML Response
.
.
.

 <title></title>
 <id>https://localhost:8089/services/server/status</id>
 <updated>2014-03-25T13:52:59-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <s:messages/>
 <entry>
   <title>dispatch-artifacts</title>
   <id>https://localhost:8089/services/server/status/dispatch-artifacts</id>
   <updated>2014-03-25T13:52:59-07:00</updated>
   <link href="/services/server/status/dispatch-artifacts" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/dispatch-artifacts" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>fishbucket</title>
   <id>https://localhost:8089/services/server/status/fishbucket</id>
   <updated>2014-03-25T13:52:59-07:00</updated>
   <link href="/services/server/status/fishbucket" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/fishbucket" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>partitions-space</title>
   <id>https://localhost:8089/services/server/status/partitions-space</id>
   <updated>2014-03-25T13:52:59-07:00</updated>
   <link href="/services/server/status/partitions-space" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/partitions-space" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>


server/status/dispatch-artifacts GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status/dispatch-artifacts
XML Response
XML Response
.
.
.
 <title>introspection--disk-objects--search-dispatch-artifacts</title>
 <id>https://localhost:8089/services/server/status/dispatch-artifacts</id>
 <updated>2014-03-25T11:10:33-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>result</title>
   <id>https://localhost:8089/services/server/status/dispatch-artifacts/result</id>
   <updated>2014-03-25T11:10:33-07:00</updated>
   <link href="/services/server/status/dispatch-artifacts/result" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/dispatch-artifacts/result" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="count_realtime">0</s:key>
       <s:key name="count_scheduled">0</s:key>
       <s:key name="count_summary">0</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="top_apps"/>
       <s:key name="top_named_searches"/>
       <s:key name="top_users"/>
       <s:key name="total_count">0</s:key>
     </s:dict>
   </content>
 </entry>


server/status/fishbucket GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status/fishbucket


XML Response
.
.
.
 <title>introspection--disk-objects--fishbucket</title>
 <id>https://localhost:8089/services/server/status/fishbucket</id>
 <updated>2014-03-25T11:31:10-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>result</title>
   <id>https://localhost:8089/services/server/status/fishbucket/result</id>
   <updated>2014-03-25T11:31:10-07:00</updated>
   <link href="/services/server/status/fishbucket/result" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/fishbucket/result" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="key_count">0</s:key>
       <s:key name="total_size">0.000</s:key>
     </s:dict>
   </content>
 </entry>


server/status/limits/search-concurrency GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status/limits/search-concurrency


XML Response
.
.
.

 <title>server-status-limits-concurrency</title>
 <id>https://localhost:8089/services/server/status/limits/search-concurrency</id>
 <updated>2014-03-25T11:40:16-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>search-concurrency</title>
   <id>https://localhost:8089/services/server/status/limits/search-concurrency/search-concurrency</id>
   <updated>2014-03-25T11:40:16-07:00</updated>
   <link href="/services/server/status/limits/search-concurrency/search-concurrency" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/limits/search-concurrency/search-concurrency" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="max_auto_summary_searches">2</s:key>
       <s:key name="max_hist_scheduled_searches">5</s:key>
       <s:key name="max_hist_searches">10</s:key>
       <s:key name="max_rt_scheduled_searches">5</s:key>
       <s:key name="max_rt_searches">10</s:key>
     </s:dict>
   </content>
 </entry>

server/status/partitions-space GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status/partitions-space


XML Response
.
.
.

 <title>introspection--disk-objects--partitions-space</title>
 <id>https://localhost:8089/services/server/status/partitions-space</id>
 <updated>2014-03-25T11:43:39-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>0</title>
   <id>https://localhost:8089/services/server/status/partitions-space/0</id>
   <updated>2014-03-25T11:43:39-07:00</updated>
   <link href="/services/server/status/partitions-space/0" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/partitions-space/0" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="capacity">104901.000</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="free">7774.000</s:key>
       <s:key name="fs_type">ntfs</s:key>
       <s:key name="mount_point">C:\</s:key>
     </s:dict>
   </content>
 </entry>

server/status/resource-usage GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status/resource-usage


XML Response
.
.
.

 <title></title>
 <id>https://localhost:8089/services/server/status/resource-usage</id>
 <updated>2014-03-25T11:53:26-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
 <s:messages/>
 <entry>
   <title>hostwide</title>
   <id>https://localhost:8089/services/server/status/resource-usage/hostwide</id>
   <updated>2014-03-25T11:53:26-07:00</updated>
   <link href="/services/server/status/resource-usage/hostwide" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/resource-usage/hostwide" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>
 <entry>
   <title>splunk-processes</title>
   <id>https://localhost:8089/services/server/status/resource-usage/splunk-processes</id>
   <updated>2014-03-25T11:53:26-07:00</updated>
   <link href="/services/server/status/resource-usage/splunk-processes" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/resource-usage/splunk-processes" rel="list"/>
   <content type="text/xml">
     <s:dict/>
   </content>
 </entry>


server/status/resource-usage/hostwide GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status/resource-usage/hostwide


XML Response
.
.
.

 <title>introspection--resource-usage--hostwide</title>
 <id>https://localhost:8089/services/server/status/resource-usage/hostwide</id>
 <updated>2014-03-25T11:45:29-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>result</title>
   <id>https://localhost:8089/services/server/status/resource-usage/hostwide/result</id>
   <updated>2014-03-25T11:45:29-07:00</updated>
   <link href="/services/server/status/resource-usage/hostwide/result" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/resource-usage/hostwide/result" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="cpu_idle_pct">90.95</s:key>
       <s:key name="cpu_system_pct">4.84</s:key>
       <s:key name="cpu_user_pct">4.21</s:key>
       <s:key name="eai:acl">
         ... elided ...
       </s:key>
       <s:key name="mem">3982.234</s:key>
       <s:key name="mem_used">3193.137</s:key>
       <s:key name="runnable_process_count">1</s:key>
       <s:key name="swap">7962.652</s:key>
       <s:key name="swap_used">3244.652</s:key>
     </s:dict>
   </content>
 </entry>


server/status/resource-usage/splunk-processes GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/server/status/resource-usage/splunk-processes/0


XML Response
.
.
.
 <title>introspection--resource-usage--splunk-processes</title>
 <id>https://localhost:8089/services/server/status/resource-usage/splunk-processes</id>
 <updated>2014-03-26T13:35:52-07:00</updated>
 <generator build="200839" version="6.1"/>
 <author>
   <name>Splunk</name>
 </author>
    ... opensearch elements elided ...
 <s:messages/>
 <entry>
   <title>0</title>
   <id>https://localhost:8089/services/server/status/resource-usage/splunk-processes/0</id>
   <updated>2014-03-26T13:35:52-07:00</updated>
   <link href="/services/server/status/resource-usage/splunk-processes/0" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/server/status/resource-usage/splunk-processes/0" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="args"> instrument-resource-usage</s:key>
       <s:key name="eai:acl">
           ... elided ...
       </s:key>
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list/>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="elapsed">619262.3610</s:key>
       <s:key name="mem_used">15.762</s:key>
       <s:key name="page_faults">12001684</s:key>
       <s:key name="pct_memory">0.40</s:key>
       <s:key name="pid">4256</s:key>
       <s:key name="ppid">2476</s:key>
       <s:key name="process">splunkd</s:key>
       <s:key name="t_count">4</s:key>
     </s:dict>
   </content>
 </entry>


PREVIOUS
Introspection endpoint descriptions
  NEXT
Knowledge endpoint descriptions

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters