Cluster endpoint descriptions

Manage master and peer cluster nodes.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

Splunk Cloud limitations

If you have a managed Splunk Cloud deployment with search head clustering and index clustering, the REST API supports access to the search head only. You can use the REST API to interact with the search head in your deployment. Using the REST API to access any other cluster member nodes is not supported. For example, index cluster management endpoints are not applicable to Splunk Cloud deployments.

Authorized users can access and configure other cluster members, including indexer, cluster master, and license master nodes, in the Splunk Cloud manager user interface. 

---

cluster/config

https://<host>:<mPort>/services/cluster/config

Description

Configure and access nodes in a cluster.

Method summary

Method	Description	Formats
GET	List cluster node configuration.	XML, JSON

---

GET cluster/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
cxn_timeout	Low-level timeout, in seconds, for establishing connection between cluster nodes. Defaults to 60 seconds.
disabled	Indicates if this node is disabled.
forwarderdata_rcv_port	The port from which to receive data from a forwarder.
forwarderdata_use_ssl	Indicates whether to use SSL when receiving data from a forwarder.
heartbeat_period	Only valid for peer nodes in a cluster. The time, in seconds, that a peer attempts to send a heartbeat to the master
heartbeat_timeout	Only valid for the master node in a cluster configuration. The time, in seconds, before a master considers a peer down. Once a peer is down, the master initiates steps to replicate buckets from the dead peer to its live peers. Defaults to 60 seconds.
master_uri	Valid only for nodes configured as a peer or searchhead. URI of the cluster master to which this node connects.
max_peer_build_load	The number of jobs that a peer can have in progress at any time that make the bucket searchable.
max_peer_rep_load	Maximum number of replications that can be ongoing as a target.
mode	Valid values: (master | slave | searchhead | disabled) Defaults to disabled. Sets operational mode for this cluster node. Only one master may exist per cluster.
ping_flag	For internal use to facilitate communication between the master and peers.
quiet_period	The time, in seconds, that a master waits for peers to add themselves to the cluster.
rcv_timeout	Low-level timeout, in seconds, for receiving data between cluster nodes. Defaults to 60 seconds.
register_forwarder_address	Not used. Reserved for future use.
register_replication_address	Valid only for nodes configured as peers. The address on which a peer is available for accepting replication data. This is useful in the cases where a peer host machine has multiple interfaces and only one of them can be reached by another splunkd instance.
register_search_address	IP address that advertises this indexer to search heads.
rep_cxn_timeout	Low-level timeout, in seconds, for establishing a connection for replicating data.
rep_max_rcv_timeout	Maximum cumulative time, in seconds, for receiving acknowledgement data from peers. Defaults to 600s.
rep_max_send_timeout	Maximum time, in seconds, for sending replication slice data between cluster nodes. Defaults to 600s.
rep_rcv_timeout	Low-level timeout, in seconds, for receiving data between cluster nodes.
rep_send_timeout	Low-level timeout, in seconds, for sending replication data between cluster nodes. Defaults to 5 seconds.
replication_factor	Only valid for nodes configured as a master. Determines how many copies of raw data are created in the cluster. This could be less than the number of cluster peers. Must be greater than 0 and greater than or equal to the search factor. Defaults to 3.
replication_port	TCP port to listen for replicated data from another cluster member.
replication_use_ssl	Indicates whether to use SSL when sending replication data.
restart_timeout	Only valid for nodes configured as a master. The amount of time, in seconds, the master waits for a peer to come back when the peer is restarted (to avoid the overhead of trying to fix the buckets that were on the peer). Defaults to 600 seconds. Note: This only works if the peer is restarted from Splunk Web.
search_factor	Only valid for nodes configured as a master. Determines how many searchable copies of each bucket to maintain. Must be less than or equal to replication_factor and greater than 0. Defaults to 2.
secret	Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master. Corresponds to pass4SymmKey setting in server.conf.
send_timeout	Low-level timeout, in seconds, for sending data between cluster nodes. Defaults to 60 seconds.

[ Top ]

cluster/master/buckets

https://<host>:<mPort>/services/cluster/master/buckets

Description

Provides bucket configuration information for a cluster master node.

Method summary

Method	Description	Formats
GET	Lists cluster master node bucket configuration.	XML, JSON

---

GET cluster/master/buckets method detail

Example

Request parameters

Use one or more filters in the query string to select buckets or bucket states. For example, use this URL to filter buckets returned for both the main index and StreamingSource status.

https://localhost:8089/services/cluster/master/buckets?filter=index=main&filter=status=StreamingSource

See the following table for available filters.

Filter name	Datatype	Description
index	String	Index name.
status	String	Bucket state. Available options are StreamingSource StreamingTarget Complete StreamingError PendingTruncate Bucket is scheduled to truncate. PendingDiscard Bucket is scheduled to discard. NonStreamingTarget
search_state	String	Bucket search state. Available options are Searchable Unsearchable PendingSearchable Bucket scheduled to become searchable by transferring or building tsidx files. PendingUnsearchable Bucket is scheduled to become unsearchable. SearchablePendingMask Primary change is scheduled or in progress.
replication_count	Number	Use <, >, != or = with numbers to indicate filtering values.
search_count	Number	Use <, >, != or = with numbers to indicate filtering values.
bucket_size	Number	Use <, >, != or = with numbers to indicate filtering values.
frozen	Boolean 1 | 0 or true | false	Return frozen buckets or non-frozen buckets.
has_primary	Boolean 1 | 0 or true | false	Return buckets with primaries or without primaries.
meets_multisite_replication_count	Boolean 1 | 0 or true | false	Return buckets that meet cluster replication policy or buckets that do not meet cluster replication policy.
meets_multisite_search_count	Boolean 1 | 0 or true | false	Return buckets that meet cluster search policy or buckets that do not meet cluster search policy.
multisite_bucket	Boolean 1 | 0 or true | false	Return buckets created in multisite mode or buckets not created in multisite mode.
origin_site	String	Site of the indexer where buckets were created.
standalone	Boolean 1 | 0 or true | false	Use true or 1 to return standalone buckets. Use false or 0 to return clustered buckets.

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
bucket_size	Indicates the size, in bytes, of the bucket.
constrain_to_origin_site	Flag indicating this particular bucket is a clustered pre-multisite bucket. Such buckets are replicated only within their origin site.
force_roll	Flag indicating hot bucket needs to be force to roll by master. Usually when hot bucket does not have enough streaming targets to meet the policy.
frozen	Indicates if the bucket is frozen.
index	Name of the index to which the bucket belongs.
origin_site	Where the bucket originated.
peers	Lists information about buckets on peers to this master.
primaries_by_site	Primary peer (GIUD).
rep_count_by_site	Number of buckets.
search_count_by_site	Number of searchable buckets.
service_after_time	Bucket service is deferred until after this time.
standalone	Indicates if the bucket was created on the peer before the peer entered into a cluster configuration with this master.

[ Top ]

cluster/master/buckets/{name}

https://<host>:<mPort>/services/cluster/master/buckets/{name}

Description

Access bucket configuration information.

Method summary

Method	Description	Formats
GET	List bucket configuration information.	XML, JSON

---

GET cluster/master/buckets/{name} method detail

Example

Request parameters

The filter parameter of the Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
bucket_size	Indicates the size, in bytes, of the bucket.
constrain_to_origin_site	Flag indicating this particular bucket is a clustered pre-multisite bucket. Such buckets are replicated only within their origin site.
force_roll	Flag indicating hot bucket needs to be force to roll by master. Usually when hot bucket does not have enough streaming targets to meet the policy.
frozen	Indicates if the bucket is frozen.
index	Name of the index to which the bucket belongs.
origin_site	Where the bucket originated.
peers	Lists information about buckets on peers to this master.
primaries_by_site	Primary peer (GIUD).
rep_count_by_site	Number of buckets.
search_count_by_site	Number of searchable buckets.
service_after_time	Bucket service is deferred until after this time.
standalone	Indicates if the bucket was created on the peer before the peer entered into a cluster configuration with this master.

[ Top ]

cluster/master/buckets/{bucket_id}/fix

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/fix

Description

Add the specified bucket to the fix list.

For more information, see "Bucket-fixing scenarios" in Managing Indexers and Clusters of Indexers.

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method	Description	Formats
POST	Add this bucket to the fix list.	XML, JSON

POST services/cluster/master/buckets/{bucket_id}/fix method detail

Example

Request parameters

None

Response data keys

None

[ Top ]

cluster/master/buckets/{bucket_id}/freeze

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/freeze

Description

Set the bucket state to frozen.

• Note: Use this endpoint with caution. It is recommended to test the endpoint prior to use on an actual bucket.
  

For more information, see "How the cluster handles frozen buckets" in Managing Indexers and Clusters of Indexers.

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method	Description	Formats
POST	Set this bucket state to frozen.	XML, JSON

---

POST services/cluster/master/buckets/{bucket_id}/freeze method detail

Example

Request parameters

None

Response data keys

None

[ Top ]

cluster/master/buckets/{bucket_id}/remove_all

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/remove_all

Description

Delete all copies of the specified bucket.

• Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test cluster prior to use on an actual bucket.
  

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method	Description	Formats
POST	Delete all copies of the specified bucket.	XML, JSON

---

POST services/cluster/master/buckets/{bucket_id}/remove_all method detail

Example

Request parameters

None

Response data keys

None. If an invalid bucket id is used, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': bucket not found</msg>
  </messages>
</response>

[ Top ]

cluster/master/buckets/{bucket_id}/remove_from_peer

https://<host>:<mPort>/services/cluster/master/buckets/{bucket_id}/remove_from_peer

Description

Deletes the copy of this bucket from specified peer.

If the request causes the cluster to lose its complete state, the cluster will engage in fixup activities. This may result in another copy of the same bucket appearing on this peer. If, however, the specified bucket is frozen, the cluster does not attempt any fixup activities.

• Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test-cluster prior to use on an actual bucket.
  

Authentication and Authorization

Requires the admin role or indexes_edit capability.

Method summary

Method	Description	Formats
POST	Delete this bucket from specified peer. Set bucket state to frozen	XML, JSON

---

POST services/cluster/master/buckets/{bucket_id}/remove_from_peer method detail

Example

Request parameters

Name	Type	Default	Description
peer (required)	GUID	N/A	Peer GUID

Response data keys

None. If the peer parameter is missing from the request, an error message is returned.

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermasterbuckets': The following required arguments are missing: peer.</msg>
  </messages>
</response>

[ Top ]

cluster/master/control/control/rebalance_primaries

https://<host>:<mPort>/services/cluster/master/control/control/rebalance_primaries

Description

Rebalance primary buckets across peers. For more information, see "Rebalance the indexer cluster primary buckets" in Managing Indexers and Clusters of Indexers.

Method summary

Method	Description	Formats
POST	Rebalance primary buckets across all peers of this master.	XML, JSON

---

POST cluster/master/control/control/rebalance_primaries method detail

Example

Request parameters

None

Response data keys

None

[ Top ]

cluster/master/control/control/remove_peers

https://<host>:<mPort>/services/cluster/master/control/control/remove_peers

Description

Remove one or more peers.

See also

cluster/master/peers

Method summary

Method	Description	Formats
POST	Remove one or more peers.	XML, JSON

---

POST cluster/master/control/control/remove_peers method detail

Example

Request parameters

Name	Type	Default	Description
peers required	String		One or more comma-separated peer GUIDs.

Response data keys

None

Application usage

If peer status is not Down or GracefulShutdown, the interface returns the following error message:

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clustermastercontrol': Remove aborted, Reason: Peer=<hostname> with guid=<peerID> cannot be removed. Peer has status=Up. Only peers with status=Down (or) GracefulShutdown can be removed.</msg>
  </messages>
</response>

[ Top ]

cluster/master/fixup

https://<host>:<mPort>/services/cluster/master/fixup

Description

Access a list of buckets on a specific fixup priority level. Bucket fixups are processed in order of priority level. See Request parameters below for priority level details.

When you access a particular fixup level, buckets may appear in it even though they do not need fixup at this level. Initially, each bucket requiring fixup is added to all levels, even though it might only require processing in a subset of all levels. As the bucket is processed through a level, it is deleted from that level.

Method summary

Method	Description	Formats
GET	List buckets on the specified fixup level.	XML, JSON

GET cluster/master/fixup method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Name	Datatype	Default	Description
level	String	N/A	Required. Fixup priority level. Use one of the following level values, listed in order of priority. streaming : Hot buckets that need to be rolled or have their size committed. data_safety : Buckets without at least two rawdata copies. generation : Buckets without a primary copy. replication_factor : Buckets without replication factor number of copies. search_factor : Buckets without search factor number of copies. checksum_sync : Level for syncing a bucket's delete files across all peers that have this bucket. Syncing is determined based on the checksum of all of the delete files.
index	String	N/A	Optional. Index name.

Response data keys

For each bucket in the specified fixup level, the response includes the following details for the initial time when the bucket went into the fixup level and the latest time that the bucket was checked.

Name	Description
id	Bucket id.
reason	Initial or latest reason for the bucket being on this fixup level.
timestamp	Timestamp for initial bucket addition to fixup list or latest bucket check.

cluster/master/generation

https://<host>:<mPort>/services/cluster/master/generation

Description

Access current generation cluster master information.

Method summary

Method	Description	Formats
GET	List peer nodes participating in the current generation for this master.	XML, JSON
POST	Create a cluster generation.	XML, JSON

---

GET cluster/master/generation method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
generation_id	The ID for the current generation for this master.
generation_peers	Lists the peers for this generation of the cluster.
pending_generation_id	The next generation ID used by the master when committing a new generation. This value is useful for debugging.
pending_last_attempt	The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason	The reason why this peer failed to commit to the pending generation. This parameter is EMPTY if no such attempt was made.

---

POST cluster/master/generation method detail

Example

Request parameters

Name	Type	Default	Description
name required	String		The URI of the searchhead node of a cluster upon which to create a new generation.
generation_poll_interval	Number		How often, in seconds, the searchhead polls the master for generation information. Defaults to 60 seconds.
label	String		Server name for the Splunk Enterprise instance specified by the name attribute.
mgmt_port	String		The managment port of searchhead node in a cluster upon which you are creating a new generation.
register_search_address	String		The address on which a peer node is available as search head. This is useful in the cases where a splunk host machine has multiple interfaces and only one of them can be reached by another splunkd instance.

Response data keys

Name	Description
generation_id	The ID for the current generation for this master.
generation_peers	Lists the peers for this generation of the cluster.
pending_generation_id	The next generation ID used by the master when committing a new generation. This value is useful for debugging.
pending_last_attempt	The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason	The reason why this peer failed to commit to the pending generation. This parameter is EMPTY if no such attempt was made.
replication_factor_met	Indicates if the replication factor was met for the cluster.
search_factor_met	Indicates if the search factor was met for the cluster.
was_forced	Indicates next generation was forcibly committed.

[ Top ]

cluster/master/generation/{name}

https://<host>:<mPort>/services/cluster/master/generation/{name}

Description

Access information about a peer node participating in the current generation for the specified search head GUID.

Method summary

Method	Description	Formats
GET	List peer node information of the specified search head GUID.	XML, JSON
POST	Create a new generation for the specified search head GUID.	XML, JSON

---

GET cluster/master/generation/{name} method detail

Example

Request parameters

None

Response data keys

Name	Description
generation_id	The ID of the current generation for this master.
generation_peers	Lists the peers for this generation of the cluster.
pending_generation_id	The next generation ID used by the master when committing a new generation. This value is useful for debugging.
pending_last_attempt	The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason	The reason why this peer failed to commit to the pending generation. This parameter is EMPTY if no such attempt was made.

---

POST cluster/master/generation/{name} method detail

Example

Request parameters

Name	Type	Default	Description
generation_poll_interval	Number		How often, in seconds, the searchhead polls the master for generation information. Defaults to 60 seconds.
label	String		Server name for the search head specified by {name}.
mgmt_port	String		The managment port of searchhead node in a cluster upon which you are creating a new generation.
register_search_address	String		The address on which a peer node is available as search head. This is useful in the cases where a splunk host machine has multiple interfaces and only one of them can be reached by another splunkd instance.

Response data keys

Name	Description
generation_id	The ID for the current generation for this master.
generation_peers	Lists the peers for this generation of the cluster.
pending_generation_id	The next generation ID used by the master when committing a new generation. This value is useful for debugging.
pending_last_attempt	The timestamp of the last attempt to commit to the pending generation ID (if ever).
pending_last_reason	The reason why this peer failed to commit to the pending generation. This parameter is EMPTY if no such attempt was made.
replication_factor_met	Indicates if the replication factor was met for the cluster.
search_factor_met	Indicates if the search factor was met for the cluster.
was_forced	Indicates next generation was forcibly committed.

[ Top ]

cluster/master/indexes

https://<host>:<mPort>/services/cluster/master/indexes

Description

Access cluster index information.

Method summary

Method	Description	Formats
GET	Lists cluster indices.	XML, JSON

---

GET cluster/master/indexes method detail

Example

Request parameters

None

Response data keys

Attribute	Description
buckets_with_excess_copies	Number of distinct buckets that have one or more excess replication copies.
buckets_with_excess_searchable_copies	Number of distinct buckets that have one or more excess searchable copies.
index_size	Size of the index
is_searchable	When every bucket in the index has a primary, the index is considered "searchable".
non_site_aware_buckets_in_site_aware_cluster	Number of buckets created when the cluster was not in a multisite config. (Included only when the cluster is in multisite config.)
num_buckets	Total number of distinct buckets.
replicated_copies_tracker	Displays how many distinct buckets have X number of copies. Attribute Description actual_copies_per_slot Number of buckets with X copies. expected_total_per_slot Expected number of buckets with X copies.
searchable_copies_tracker	Displays how many distinct buckets have X number of searchable copies. Attribute Description actual_copies_per_slot Number of buckets with X searchable copies. expected_total_per_slot Expected number of buckets with X searchable copies.
sort_order	Used by UI.
total_excess_bucket_copies	Total number of excess copies for all buckets.
total_excess_searchable_copies	Total number of excess searchable copies for all buckets.

[ Top ]

cluster/master/indexes/{name}

https://<host>:<mPort>/services/cluster/master/indexes/{name}

Description

Access specific cluster index information.

Method summary

Method	Description	Formats
GET	Lists index information.	XML, JSON

---

GET cluster/master/indexes/{name} method detail

Example

Request parameters

None

Response data keys

Attribute	Description
buckets_with_excess_copies	Number of distinct buckets that have one or more excess replication copies.
buckets_with_excess_searchable_copies	Number of distinct buckets that have one or more excess searchable copies.
index_size	Size of the index
is_searchable	When every bucket in the index has a primary, the index is considered "searchable".
non_site_aware_buckets_in_site_aware_cluster	Number of buckets created when the cluster was not in a multisite config. (Included only when the cluster is in multisite config.)
num_buckets	Total number of distinct buckets.
replicated_copies_tracker	Displays how many distinct buckets have X number of copies. Attribute Description actual_copies_per_slot Number of buckets with X copies. expected_total_per_slot Expected number of buckets with X copies.
searchable_copies_tracker	Displays how many distinct buckets have X number of searchable copies. Attribute Description actual_copies_per_slot Number of buckets with X searchable copies. expected_total_per_slot Expected number of buckets with X searchable copies.
sort_order	Used by UI.
total_excess_bucket_copies	Total number of excess copies for all buckets.
total_excess_searchable_copies	Total number of excess searchable copies for all buckets.

[ Top ]

cluster/master/info

https://<host>:<mPort>/services/cluster/master/info

Description

Access information about cluster master node.

Method summary

Method	Description	Formats
GET	List cluster master node details.	XML, JSON

---

GET cluster/master/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
active_bundle	Provides information about the active bundle for this master.
bundle_creation_time_on_master	The time, in epoch seconds, when the bundle was created on the master.
bundle_validation_errors_on_master	A list of bundle validation errors.
bundle_validation_in_progress	Indicates if bundle validation is in progress.
bundle_validation_on_master_succeeded	Indicates whether the master succeeded validating bundles.
data_safety_buckets_to_fix	Lists the buckets to fix for the completion of data safety.
gen_commit_buckets_to_fix	The buckets to be fixed before the next generation can be committed.
indexing_ready_flag	Indicates if the cluster is ready for indexing.
initialized_flag	Indicates if the cluster is initialized.
label	The name for the master that is displayed in the Splunk Enterprise Manager page.
latest_bundle	The most recent information reflecting any changes made to the master-apps configuration bundle. In steady state, this is equal to active_bundle. If it is not equal, then pushing the latest bundle to all peers is in process (or needs to be started).
maintenance_mode	Indicates if the cluster is in maintenance mode.
reload_bundle_issued	Indicates if the bundle issued is being reloaded.
rep_count_buckets_to_fix	Number of buckets to fix on peers.
rolling_restart_flag	Indicates whether the master is restarting the peers in a cluster.
search_count_buckets_to_fix	Number of buckets to fix to satisfy the search count.
service_ready_flag	Indicates whether the master is ready to begin servicing, based on whether it is initialized.
start_time	Timestamp corresponding to the creation of the master.

[ Top ]

cluster/master/peers

https://<host>:<mPort>/services/cluster/master/peers

Description

Access cluster master peers.

See also

cluster/master/control/control/remove_peers

Method summary

Method	Description	Formats
GET	List cluster master peers.	XML, JSON

---

GET cluster/master/peers method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
active_bundle_id	The ID of the configuration bundle currently being used by the master.
apply_bundle_status	Bundle status enumeration.
base_generation_id	The initial bundle generation ID recognized by this peer. Any searches from previous generations fail. The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.
bucket_count	Count of the number of buckets on this peer, across all indexes.
bucket_count_by_index	Count of the number of buckets by index on this peer.
delayed_buckets_to_discard	List of bucket IDs waiting to be discarded on this peer.
fixup_set	The set of buckets that need repair once you take the peer offline.
heartbeat_started	Flag indicating if this peer has started heartbeating.
host_port_pair	The host and port advertised to peers for the data replication channel. Can be either of the form IP:port or hostname:port.
is_searchable	Flag indicating if this peer belongs to the current committed generation and is searchable.
label	The name for the peer that is displayed in the Splunk Enterprise Manager page.
last_heartbeat	Timestamp for last heartbeat recieved from the peer.
latest_bundle_id	The ID of the configuration bundle this peer is using.
pending_job_count	Used by the master to keep track of pending jobs requested by the master to this peer.
primary_count	Number of buckets for which the peer is primary in its local site, or the number of buckets that return search results from same site as the peer.
primary_count_remote	Number of buckets for which the peer is primary that are not in its local site.
replication_count	Number of replications this peer is part of, as either source or target.
replication_port	TCP port to listen for replicated data from another cluster member.
replication_use_ssl	Indicates whether to use SSL when sending replication data.
search_state_counter	Lists the number of buckets on the peer for each search state for the bucket. Possible values for search state include: Searchable Unsearchable
site	To which site the peer belongs.
status	Indicates the status of the peer. Valid values are: Up Down Pending Detention Restarting DecommAwaitPeer DecommFixingBuckets Decommissioned
status_counter	Lists the number of buckets on the peer for each bucket status. Possible values for bucket status: Complete: complete (warm/cold) bucket NonStreamingTarget: target of replication for already completed (warm/cold) bucket PendingTruncate: bucket pending truncation PendingDiscard: bucket pending discard Standalone: bucket that is not replicated StreamingError: copy of streaming bucket where some error was encountered StreamingSource: streaming hot bucket on source side StreamingTarget: streaming hot bucket copy on target side Unset: uninitialized

[ Top ]

cluster/master/peers/{name}

https://<host>:<mPort>/services/cluster/master/peers/{name}

Description

Access specified peer.

Method summary

Method	Description	Formats
GET	Get {name} peer information.	XML, JSON

---

GET cluster/master/peers/{name} method detail

Example

Request parameters

Name	Type	Default	Description
list_buckets	Boolean		Indicates whether to list the buckets for the peers to this master.

Response data keys

Name	Description
active_bundle_id	The ID of the configuration bundle currently being used by the master.
apply_bundle_status	Bundle status enumeration.
base_generation_id	The initial bundle generation ID recognized by this peer. Any searches from previous generations fail. The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.
bucket_count	Count of the number of buckets on this peer, across all indexes.
bucket_count_by_index	Count of the number of buckets by index on this peer.
delayed_buckets_to_discard	List of bucket IDs waiting to be discarded on this peer.
fixup_set	The set of buckets that need repair once you take the peer offline.
heartbeat_started	Flag indicating if this peer has started heartbeating.
host_port_pair	The host and port advertised to peers for the data replication channel. Can be either of the form IP:port or hostname:port.
is_searchable	Flag indicating if this peer belongs to the current committed generation and is searchable.
label	The name for the peer that is displayed in the Splunk Enterprise Manager page.
last_heartbeat	Timestamp for last heartbeat recieved from the peer.
latest_bundle_id	The ID of the configuration bundle this peer is using.
pending_job_count	Used by the master to keep track of pending jobs requested by the master to this peer.
primary_count	Number of buckets for which the peer is primary in its local site, or the number of buckets that return search results from same site as the peer.
primary_count_remote	Number of buckets for which the peer is primary that are not in its local site.
replication_count	Number of replications this peer is part of, as either source or target.
replication_port	TCP port to listen for replicated data from another cluster member.
replication_use_ssl	Indicates whether to use SSL when sending replication data.
search_state_counter	Lists the number of buckets on the peer for each search state for the bucket. Possible values for search state include: Searchable Unsearchable
site	To which site the peer belongs.
status	Indicates the status of the peer. Valid values are: Up Down Pending Detention Restarting DecommAwaitPeer DecommFixingBuckets Decommissioned
status_counter	Lists the number of buckets on the peer for each bucket status. Possible values for bucket status: Complete: complete (warm/cold) bucket NonStreamingTarget: target of replication for already completed (warm/cold) bucket PendingTruncate: bucket pending truncation PendingDiscard: bucket pending discard Standalone: bucket that is not replicated StreamingError: copy of streaming bucket where some error was encountered StreamingSource: streaming hot bucket on source side StreamingTarget: streaming hot bucket copy on target side Unset: uninitialized

[ Top ]

cluster/master/sites

https://<host>:<mPort>/services/cluster/master/sites

Description

Access cluster site information.

Method summary

Method	Description	Formats
GET	List available cluster sites.	XML, JSON

---

GET cluster/master/sites method detail

Example

Request parameters

None

Response data keys

Name	Description
peers	Peers list of host:port and server name.

[ Top ]

cluster/master/sites/{name}

https://<host>:<mPort>/services/cluster/master/sites/{name}

Description

Access specific cluster site information.

Method summary

Method	Description	Formats
GET	List specific cluster site information.	XML, JSON

---

GET cluster/master/sites/{name} method detail

Example

Request parameters

None

Response data keys

Name	Description
peers	Site peer reference, for each peer: Attribute Description host_port_pair Peer port number. server_name Peer server name.

[ Top ]

cluster/searchhead/generation

https://<host>:<mPort>/services/cluster/searchhead/generation

Description

Access peer information in a cluster searchhead.

Method summary

Method	Description	Formats
GET	List peers available to a cluster searchhead.	XML, JSON

---

GET cluster/searchhead/generation method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
generation_id	The current generation ID for this searchhead, which is part of a cluster configuration. The search head uses this information to determine which buckets to search across.
generation_peers	List of peer nodes for the current generation in the cluster configuration for this searchhead.

[ Top ]

cluster/searchhead/generation/{name}

https://<host>:<mPort>/services/cluster/searchhead/generation/{name}

Description

Access peer of the master URI.

Method summary

Method	Description	Formats
GET	Get {name} searchhead generation ID and generation peers.	XML, JSON

---

GET cluster/searchhead/generation/{name} method detail

Example

Request parameters

None

Response data keys

Name	Description
generation_id	The current generation ID for this searchhead, which is part of a cluster configuration. The search head uses this information to determine which buckets to search across.
generation_peers	List of peer nodes for the current generation in the cluster configuration for this searchhead.

[ Top ]

cluster/searchhead/searchheadconfig

https://<host>:<mPort>/services/cluster/searchhead/searchheadconfig

Description

Access cluster searchhead node configuration.

Method summary

Method	Description	Formats
GET	List this cluster search head node configuration.	XML, JSON
POST	Configure this server as a cluster searchhead node.	XML, JSON

---

GET cluster/searchhead/searchheadconfig method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

None

---

POST cluster/searchhead/searchheadconfig method detail

Example

Request parameters

Name	Type	Default	Description
name required	String		The URI of the master node in the cluster.
secret required	String		Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master. Corresponds to pass4SymmKey setting in server.conf.

Response data keys

None

[ Top ]

cluster/searchhead/searchheadconfig/{name}

https://<host>:<mPort>/services/cluster/searchhead/searchheadconfig/{name}

Description

Manage node in a cluster.

Method summary

Method	Description	Formats
DELETE	Remove node from cluster.	XML, JSON
GET	List cluster search head node configuration.	XML, JSON
POST	Update cluster search head node configuration.	XML, JSON

---

DELETE cluster/searchhead/searchheadconfig/{name} method detail

Example

Request parameters

None

Response data keys

None

---

GET cluster/searchhead/searchheadconfig/{name} method detail

Example

Request parameters

None

Response data keys

None

---

POST cluster/searchhead/searchheadconfig/{name} method detail

Request parameters

Name	Type	Default	Description
master_uri	String		The URI of the master node in the cluster for which this searchhead is configured.
secret	String		Secret shared among the nodes in the cluster to prevent any arbitrary node from connecting to the cluster. If a peer or searchhead is not configured with the same secret as the master, it is not able to communicate with the master. Corresponds to pass4SymmKey setting in server.conf.

Response data keys

None

[ Top ]

cluster/slave/buckets

https://<host>:<mPort>/services/cluster/slave/buckets

Description

Access cluster peers bucket configuration.

Method summary

Method	Description	Formats
GET	List cluster peers bucket configuration.	XML, JSON

---

GET cluster/slave/buckets method detail

Example

Request parameters

Name	Type	Default	Description
generation_id	String		The generation ID for this peer. For each generation, the master server in a cluster configuration assigns generation IDs. A generation identifies which copies of a cluster's buckets are primary and therefore can participate in a search.

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
checksum	Used internally to identify this bucket.
earliest_time	Indicates the time of the earliest event in this bucket.
generation_id	The generation ID for this peer.
generations	A sparse list of generation id to bucket primacy for the given peer.
latest_time	Indicates the time for the latest event in this bucket.
search_state	Indicates if the bucket is searchable. Possible values: Searchable Unsearchable
status	Indicates the status of this bucket. Possible values: Complete: Copy of this bucket contains the full complement of information StreamingSource: The copy of this bucket is sending data to peer nodes for replication StreamingTarget: The copy of this bucket is receiving replicated data. NonStreamingTarget: This copy of a warm bucket replication is in progress. Once replication is complete, the status changes to Complete. StreamingError: the copy of this bucket encountered errors while streaming data. PendingTruncate: The master asked the peer to truncate this copy of the bucket to a certain size and is waiting for confirmation. PendingDiscard: The master asked the peer to discard this copy of the bucket (for whatever reason, and is waiting for confirmation. Standalone: A bucket in the cluster that is not replicated.

[ Top ]

cluster/slave/buckets/{name}

https://<host>:<mPort>/services/cluster/slave/buckets/{name}

Description

Manage peer buckets.

Method summary

Method	Description	Formats
DELETE	Remove specified bucket from peer node.	XML, JSON
GET	List peer specified bucket information.	XML, JSON

---

DELETE cluster/slave/buckets/{name} method detail

Example

Request parameters

Name	Type	Default	Description
bucket_id required	String		The identifier for the bucket to remove.

Response data keys

None

---

GET cluster/slave/buckets/{name} method detail

Example

Request parameters

Name	Type	Default	Description
generation_id	String		The generation ID for this peer. For each generation, the master server in a cluster configuration assigns generation IDs. A generation identifies which copies of a cluster's buckets are primary and therefore can participate in a search.

Response data keys

Name	Description
checksum	Used internally to identify this bucket.
earliest_time	Indicates the time of the earliest event in this bucket.
generation_id	The generation ID for this peer.
generations	A sparse list of generation id to bucket primacy for the given peer.
latest_time	Indicates the time for the latest event in this bucket.
search_state	Indicates if the bucket is searchable. Possible values: Searchable Unsearchable
status	Indicates the status of this bucket. Possible values: Complete: Copy of this bucket contains the full complement of information StreamingSource: The copy of this bucket is sending data to peer nodes for replication StreamingTarget: The copy of this bucket is receiving replicated data. NonStreamingTarget: This copy of a warm bucket replication is in progress. Once replication is complete, the status changes to Complete. StreamingError: the copy of this bucket encountered errors while streaming data. PendingTruncate: The master asked the peer to truncate this copy of the bucket to a certain size and is waiting for confirmation. PendingDiscard: The master asked the peer to discard this copy of the bucket (for whatever reason, and is waiting for confirmation. Standalone: A bucket in the cluster that is not replicated.

[ Top ]

cluster/slave/control/control/re-add-peer

https://<host>:<mPort>/services/cluster/slave/control/control/re-add-peer

Description

Set the peer to re-add itself to the master. This syncs the peer's state, including its in-memory bucket state, to the master. By default, this resets the peer's primary bucket copies and the master reassigns them across the cluster. To keep the peer's existing primary bucket copies, use the optional clearMasks=false parameter.

This endpoint can be useful when the master and the peer have a state mismatch, for example when bucket information is not in sync between them.

Method summary

Method	Description	Formats
POST	Re-add the cluster indexer to the cluster master.	XML, JSON

Example

Request parameters

Name	Type	Default	Description
clearMasks	Boolean. Use true or false.	true	Optional. Indicates whether the master should reassign all primary bucket copies across all peers. The default true value prompts the master to reassign all primary bucket copies across all peers. Use false to re-add the peer but keep the existing primary bucket copies.

[ Top ]

cluster/slave/control/control/set_detention_override

https://<host>:<mPort>/services/cluster/slave/control/control/set_detention_override 

Authentication: Required.

Description

Adjust a cluster peer's eligibility for data replication. You can use this endpoint to manually set a clustered indexer to detention mode or to reverse this setting.

• Note: manual detention settings are not persisted upon restarts.

Method summary

Method	Description	Formats
POST	Adjust clustered indexer detention mode.	XML, JSON

Request parameters

Name	Type	Default	Description
value	Boolean		Indicates whether indexer is set to detention mode.

Response data keys

None

Application usage

If an invalid key or value is passed as the request parameter, a detailed error message is sent in response.

Example: Invalid value passed

$ curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d value=BADVALUE -X POST

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clusterslavecontrol': key=value with val=BADVALUE is not a valid boolean value</msg>
  </messages>
</response>

Example: invalid argument passed

$ curl -k -u admin:changeme https://SLAVE:MGMT_PORT/services/cluster/slave/control/control/set_detention_override -d badArgument=true -X POST

<response>
  <messages>
    <msg type="ERROR">
 In handler 'clusterslavecontrol': Argument "badArgument" is not supported by this handler.</msg>
  </messages>
</response>

cluster/slave/info

https://<host>:<mPort>/services/cluster/slave/info

Description

Access cluster peer node information.

Method summary

Method	Description	Formats
GET	List peer information.	XML, JSON

---

GET cluster/slave/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

active_bundle	Current bundle being used by this peer.
base_generation_id	The initial bundle generation ID recognized by this peer. Any searches from previous generations fail. The initial bundle generation ID is created when a peer first comes online, restarts, or recontacts the master.
invalid_bundle_ids	List of bundle ids with validation errors in the peer.
is_registered	Indicates if this peer is registered with the master in the cluster.
last_heartbeat_attempt	Timestamp for the last attempt to contact the master.
latest_bundle	Lists information about the most recent bundle downloaded from the master.
restart_state	Indicates whether the peer needs to be restarted to enable its cluster configuration.
status	Indicates the status of the peer. Possible values: Up Down Pending Detention Restarting DecommAvaitingPeer DecommFixingBuckets Decommissioned

[ Top ]

shcluster/captain/artifacts

https://<host>:<mPort>/services/shcluster/captain/artifacts

Description

Provides list of artifacts and replicas for a searchhead cluster.

An artifact in search head clustering is a managed search directory. Currently only scheduled search results directories are managed, and replicated according to replication policy. This endpoint can only be accessed on the captain. The artifacts listed are all the artifacts that are currently managed by the captain across the searchhead cluster, present on the various members. NB: adhoc searches are not considered artifacts and are not listed.

Method summary

Method	Description	Formats
GET	Lists searchhead cluster artifacts and replicas	XML, JSON

GET shcluster/captain/artifacts method detail

Example

Request parameters

Name	Type	Default	Description
remote_sids required	Bool		Set this to true to return the searches that the captain is seeing. Will include adhoc searches on remote members.

Response data keys

artifact_size	Artifact size, in bytes.
origin_guid	Guid of the origin peer where this artifact was created/search was run.
peers	Lists information about replicas of this artifact on members of this searchhead cluster.
service_after_time	Artifact service/fixup is deferred until after this time.

---

[ Top ]

shcluster/captain/artifacts/{name}

https://<host>:<mPort>/services/shcluster/captain/artifacts/{name}

Description

Get artifact information for a specific artifact.

Method summary

Method	Description	Formats
GET	Get artifact information, size, replicas and earliest service time.	XML, JSON

GET shcluster/captain/artifacts/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

artifact_size	Artifact size, in bytes.
origin_guid	Guid of the origin peer where this artifact was created.
peers	Lists information about artifacts on members of this captain.
service_after_time	Artifact service is deferred until after this time.

---

[ Top ]

shcluster/captain/info

https://<host>:<mPort>/services/shcluster/captain/info

Description

Access information about searchhead cluster captain node.

Method summary

Method	Description	Formats
GET	List searchhead cluster captain node details.	XML, JSON

---

GET shcluster/captain/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

elected_captain	Time when the current captain was elected
id	Id of this SH cluster. This is used as the unique identifier for the Search Head Cluster in bundle replication and acceleration summary management.
initialized_flag	Indicates if the searchhead cluster is initialized.
label	The name for the captain that is displayed in the Splunk Enterprise Manager page.
maintenance_mode	Indicates if the cluster is in maintenance mode.
min_peers_joined_flag	Flag to indicate if more then replication_factor peers have joined the cluster.
peer_scheme_host_port	URI of the current captain.
rolling_restart_flag	Indicates whether the captain is restarting the members in a searchhead cluster.
service_ready_flag	Indicates whether the captain is ready to begin servicing, based on whether it is initialized.
start_time	Timestamp corresponding to the creation of the captain.

[ Top ]

shcluster/captain/jobs

https://<host>:<mPort>/services/shcluster/captain/jobs

Description

List running and recently finished jobs for all cluster members.

Method summary

Method	Description	Formats
GET	Cluster-wide list of running and recently finished jobs	XML, JSON

---

GET shcluster/captain/jobs method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each job:

ATTEMPT_[n]	dispatch_time - The UTC time of dispatch for the job errormsg - If the job failed, capturing the reason for failure peer - GUID of the member that the job was sent to sid - the search id of this attempt success - a boolean for success/failure of the job
job_state	Job State can be SCHEDULED/DISPATCHED/COMPLETED. A SCHEDULED job has been received by the captain from the scheduler to schedule. A DISPATCHED job has started to run on a remote member. A COMPLETED job has finished running on the remote member.
saved_search	The name of the saved-search from the associated savedsearches.conf file.
savedsearchtype	The scheduler manages three kinds of scheduled jobs, regular savedsearch for both realtime and historical, autosummary report acceleration build searches, and tsidx tsidx build searches.
search_app	The application in which the savedsearch was created.
search_owner	The owner of the saved search.

---

[ Top ]

shcluster/captain/jobs/{name}

https://<host>:<mPort>/services/shcluster/captain/jobs/{name}

Description

Get running and recently finished jobs for {name} cluster.

Method summary

Method	Description	Formats
GET	Get running and recently finished jobs.	XML, JSON

---

GET shcluster/captain/jobs/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

ATTEMPT_[n]	dispatch_time - The UTC time of dispatch for the job errormsg - If the job failed, capturing the reason for failure peer - GUID of the member that the job was sent to sid - the search id of this attempt success - a boolean for success/failure of the job
job_state	Job State can be SCHEDULED/DISPATCHED/COMPLETED. A SCHEDULED job has been received by the captain from the scheduler to schedule. A DISPATCHED job has started to run on a remote member. A COMPLETED job has finished running on the remote member.
saved_search	The name of the saved-search from the associated savedsearches.conf file.
savedsearchtype	The scheduler manages three kinds of scheduled jobs, regular savedsearch for both realtime and historical, autosummary report acceleration build searches, and tsidx tsidx build searches.
search_app	The application in which the savedsearch was created.
search_owner	The owner of the saved search.

---

[ Top ]

shcluster/captain/members

https://<host>:<mPort>/services/shcluster/captain/members

Description

Lists the search head cluster members.

Method summary

Method	Description	Formats
GET	List cluster members.	XML, JSON

---

GET shcluster/captain/members method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

adhoc_searchhead	Flag to indicate if this member does not run scheduled searches.
advertise_restart_required	Flag to indicate if this peer advertised that it needed a restart.
artifact_count	Number of artifacts on this peer
delayed_artifacts_to_discard	List of artifacts waiting to be deleted from this peer.
fixup_set	N/A
host_port_pair	The host and management port advertised by this peer.
kv_store_host_port	Host and port of the kv store instance of this member.
label	The name for this member that is displayed in the Splunk Enterprise Manager page.
last_heartbeat	Timestamp for last heartbeat recieved from the peer
peer_scheme_host_port	URI of the current captain.
pending_job_count	Used by the captain to keep track of pending jobs requested by the captain to this member.
replication_count	Number of replications this peer is part of, as either source or target.
replication_port	TCP port to listen for replicated data from another cluster member.
replication_use_ssl	Indicates whether to use SSL when sending replication data.
site	N/A
status	Indicates the status of the member. Valid values are: Up Down Pending Detention Restarting DecommAwaitPeer DecommFixingBuckets Decommissioned
status_counter	Lists the number of buckets on the peer for each bucket status. Possible values for bucket status: Complete: complete (warm/cold) bucket NonStreamingTarget: target of replication for already completed (warm/cold) bucket PendingTruncate: bucket pending truncation PendingDiscard: bucket pending discard Standalone: bucket that is not replicated StreamingError: copy of streaming bucket where some error was encountered StreamingSource: streaming hot bucket on source side StreamingTarget: streaming hot bucket copy on target side Unset: uninitialized

---

[ Top ]

shcluster/captain/members/{name}

https://<host>:<mPort>/services/shcluster/captain/members/{name}

Description

Get information about the {name} searchhead cluster member.

Method summary

Method	Description	Formats
GET	Get information about the {name} searchhead cluster member.	XML, JSON

---

GET shcluster/captain/members/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

adhoc_searchhead	Flag to indicate if this member does not run scheduled searches.
advertise_restart_required	Flag to indicate if this peer advertised that it needed a restart.
artifact_count	Number of artifacts on this peer.
delayed_artifacts_to_discard	List of artifacts waiting to be deleted from this peer.
fixup_set	N/A
host_port_pair	The host and management port advertised by this peer.
kv_store_host_port	Host and port of the kv store instance of this member.
label	The name for this member displayed in the Splunk Enterprise Manager page.
last_heartbeat	Timestamp for last heartbeat recieved from the peer
peer_scheme_host_port	URI of the current captain.
pending_job_count	Used by the master to keep track of pending jobs requested by the master to this peer.
replication_count	Number of replications this peer is part of, as either source or target.
replication_port	TCP port to listen for replicated data from another cluster member.
replication_use_ssl	Indicates whether to use SSL when sending replication data.
site	N/A
status	Indicates the status of the member. Valid values are: Up Down Pending Detention Restarting DecommAwaitPeer DecommFixingBuckets Decommissioned
status_counter	Lists the number of buckets on the peer for each bucket status. Possible values for bucket status: Complete: complete (warm/cold) bucket NonStreamingTarget: target of replication for already completed (warm/cold) bucket PendingTruncate: bucket pending truncation PendingDiscard: bucket pending discard Standalone: bucket that is not replicated StreamingError: copy of streaming bucket where some error was encountered StreamingSource: streaming hot bucket on source side StreamingTarget: streaming hot bucket copy on target side Unset: uninitialized

---

[ Top ]

shcluster/config

https://<host>:<mPort>/services/shcluster/config

Description

List searchhead cluster node configuration.

Method summary

Method	Description	Formats
GET	List searchhead cluster node configuration.	XML, JSON

---

GET shcluster/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
cxn_timeout	Low-level timeout, in seconds, for establishing connection between searchhead cluster nodes. Defaults to 60 seconds.
disabled	Indicates if this node is disabled.
heartbeat_period	Only valid for member nodes in a searchhead cluster. The time, in seconds, that a member attempts to send a heartbeat to the captain
heartbeat_timeout	Only valid for the captain node in a searchhead cluster configuration. The time, in seconds, before a captain considers a member down. Once a member is down, the captain initiates steps to replicate artifacts from the dead member to its live members. Defaults to 60 seconds.
id	Id of the SH cluster this member is a part of.
max_peer_rep_load	Maximum number of replications that can be ongoing as a target.
mode	Valid values: (disabled, member, captain, dynamic_captain) Defaults to disabled. Multiple values are permitted. Operational mode for this searchhead cluster node. Only one captain may exist per searchhead cluster.
percent_peers_to_restart	Percentage of peers to restart at the same time when doing a rolling restart.
ping_flag	For internal use to facilitate communication between the captain and members.
quiet_period	The time, in seconds, that a captain waits for members to add themselves to the searchhead cluster.
rcv_timeout	Low-level timeout, in seconds, for receiving data between searchhead cluster nodes. Defaults to 60 seconds.
register_replication_address	Valid only for nodes configured as members. The address on which a member is available for accepting replication data. This is useful in the cases where a member host machine has multiple interfaces and only one of them can be reached by another splunkd instance.
rep_cxn_timeout	Low-level timeout, in seconds, for establishing a connection for replicating data.
rep_max_rcv_timeout	Maximum cumulative time, in seconds, for receiving acknowledgement data from members. Defaults to 600s.
rep_max_send_timeout	Maximum time, in seconds, for sending replication slice data between searchhead cluster nodes. Defaults to 600s.
rep_rcv_timeout	Low-level timeout, in seconds, for receiving data between searchhead cluster nodes.
rep_send_timeout	Low-level timeout, in seconds, for sending replication data between searchhead cluster nodes. Defaults to 5 seconds.
replication_factor	Only valid for nodes configured as a captain. Determines how many copies of raw data are created in the searchhead cluster. This could be less than the number of searchhead cluster members. Must be greater than 0 and greater than or equal to the search factor. Defaults to 3.
replication_port	TCP port to listen for replicated data from another searchhead cluster member.
replication_use_ssl	Indicates whether to use SSL when sending replication data.
restart_timeout	Only valid for nodes configured as a captain. The amount of time, in seconds, the captain waits for a member to come back when the member is restarted (to avoid the overhead of trying to fix the artifacts that were on the member). Defaults to 600 seconds. Note: This only works if the member is restarted from Splunk Web.
secret	Secret shared among the nodes in the searchhead cluster to prevent any arbitrary node from connecting to the searchhead cluster. If a member or searchhead is not configured with the same secret as the captain, it is not able to communicate with the captain. Corresponds to pass4SymmKey setting in server.conf.
send_timeout	Low-level timeout, in seconds, for sending data between searchhead cluster nodes. Defaults to 60 seconds.

[ Top ]

shcluster/member/artifacts

https://<host>:<mPort>/services/shcluster/member/artifacts

Description

Manage searchhead cluster member artifact configuration.

Method summary

Method	Description	Formats
GET	List searchhead cluster members artifact configuration.	XML, JSON

GET shcluster/member/artifacts method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each member:

status

Indicates the status of this artifact. Possible values: Complete: Copy of this artifact contains the full complement of information. StreamingSource: The copy of this artifact is sending data to member nodes for replication. StreamingTarget: The copy of this artifact is receiving replicated data. NonStreamingTarget: This copy of a warm artifact replication is in progress. Once replication is complete, the status changes to Complete. StreamingError: the copy of this artifact encountered errors while streaming data. PendingTruncate: The captain asked the member to truncate this copy of the artifact to a certain size and is waiting for confirmation. PendingDiscard: The captain asked the member to discard this copy of the artifact (for whatever reason, and is waiting for confirmation. Standalone: A artifact in the searchhead cluster that is not replicated.

[ Top ]

shcluster/member/artifacts/{name}

https://<host>:<mPort>/services/shcluster/member/artifacts/{name}

Description

Get {name} member artifact configuration.

Method summary

Method	Description	Formats
GET	List {name} member artifact information.	XML, JSON

GET shcluster/member/artifacts/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

status

Indicates the status of this artifact. Possible values: Complete: Copy of this artifact contains the full complement of information. StreamingSource: The copy of this artifact is sending data to member nodes for replication. StreamingTarget: The copy of this artifact is receiving replicated data. NonStreamingTarget: This copy of a warm artifact replication is in progress. Once replication is complete, the status changes to Complete. StreamingError: the copy of this artifact encountered errors while streaming data. PendingTruncate: The captain asked the member to truncate this copy of the artifact to a certain size and is waiting for confirmation. PendingDiscard: The captain asked the member to discard this copy of the artifact (for whatever reason, and is waiting for confirmation. Standalone: A artifact in the searchhead cluster that is not replicated.

[ Top ]

shcluster/member/consensus

https://<host>:<mPort>/services/shcluster/member/consensus

Description

Get latest cluster configuration from the raft consensus protocol.

Method summary

Method	Description	Formats
GET	Get latest cluster configuration from the raft consensus protocol.	XML, JSON

---

GET shcluster/member/consensus method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each member:

configuration_id	Unique id for this configuration.
servers_list	Comma-separated list of members that are part of the cluster. Each member is listed as scheme://host:port

[ Top ]

shcluster/member/info

https://<host>:<mPort>/services/shcluster/member/info

Description

Access searchhead cluster member node information.

Method summary

Method	Description	Formats
GET	List member information.	XML, JSON

---

GET shcluster/member/info method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each member:

adhoc_searchhead	Flag that indicates if this member can run scheduled searches.
is_registered	Indicates if this member is registered with the searchhead cluster captain.
last_heartbeat_attempt	Timestamp for the last attempt to contact the captain.
maintenance_mode	N/A
peer_load_stats_gla_15m	Number of scheduled searches run in the last 15 minutes.
peer_load_stats_gla_1m	Number of scheduled searches run in the last one minute.
peer_load_stats_gla_5m	Number of scheduled searches run in the last five minutes.
peer_load_stats_max_runtime	N/A
peer_load_stats_num_autosummary	N/A
peer_load_stats_num_historical	N/A
peer_load_stats_num_realtime	N/A
peer_load_stats_num_running	N/A
peer_load_stats_total_runtime	N/A
restart_state	Indicates whether the member needs to be restarted to enable its searchhead cluster configuration.
status	Indicates the status of the member. Possible values: Up Down Pending Detention Restarting DecommAvaitingPeer DecommFixingBuckets Decommissioned

[ Top ]