
Configuration endpoint examples
configs/conf-{file} GET
XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/configs/conf-props
XML Response
. . . <title>conf-props</title> <id>https://localhost:8089/services/configs/conf-props</id> <updated>2011-07-08T01:01:26-07:00</updated> <generator version="102807"/> <author> <name>Splunk</name> </author> <link href="/services/configs/conf-props/_new" rel="create"/> <link href="/services/configs/conf-props/_reload" rel="_reload"/> <!-- opensearch nodes elided for brevity. --> <s:messages/> <entry> <title>(?i)source::....zip(.\d+)?</title> <id>https://localhost:8089/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F</id> <updated>2011-07-08T01:01:26-07:00</updated> <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="alternate"/> <author> <name>nobody</name> </author> <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="list"/> <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F/_reload" rel="_reload"/> <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F" rel="edit"/> <link href="/servicesNS/nobody/system/configs/conf-props/%28%3Fi%29source%3A%3A....zip%28.%5Cd%2B%29%3F/disable" rel="disable"/> <content type="text/xml"> <s:dict> <s:key name="ANNOTATE_PUNCT">1</s:key> <s:key name="BREAK_ONLY_BEFORE"/> <s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key> <s:key name="CHARSET">UTF-8</s:key> <s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key> <s:key name="HEADER_MODE"/> <s:key name="LEARN_SOURCETYPE">1</s:key> <s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key> <s:key name="MAX_DAYS_AGO">2000</s:key> <s:key name="MAX_DAYS_HENCE">2</s:key> <s:key name="MAX_DIFF_SECS_AGO">3600</s:key> <s:key name="MAX_DIFF_SECS_HENCE">604800</s:key> <s:key name="MAX_EVENTS">256</s:key> <s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key> <s:key name="MUST_BREAK_AFTER"/> <s:key name="MUST_NOT_BREAK_AFTER"/> <s:key name="MUST_NOT_BREAK_BEFORE"/> <s:key name="NO_BINARY_CHECK">1</s:key> <s:key name="SEGMENTATION">indexing</s:key> <s:key name="SEGMENTATION-all">full</s:key> <s:key name="SEGMENTATION-inner">inner</s:key> <s:key name="SEGMENTATION-outer">outer</s:key> <s:key name="SEGMENTATION-raw">none</s:key> <s:key name="SEGMENTATION-standard">standard</s:key> <s:key name="SHOULD_LINEMERGE">1</s:key> <s:key name="TRANSFORMS"/> <s:key name="TRUNCATE">10000</s:key> <s:key name="disabled">0</s:key> <!-- eai:acl nodes elided for brevity. --> <s:key name="eai:appName">search</s:key> <s:key name="eai:userName">admin</s:key> <s:key name="maxDist">100</s:key> <s:key name="sourcetype">preprocess-zip</s:key> <s:key name="unarchive_cmd">_auto</s:key> </s:dict> </content> </entry>
configs/conf-{file} POST
XML
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props -d name=myblog
XML Response
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?> <feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title>conf-props</title> <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id> <updated>2015-07-17T10:50:13+08:00</updated> <generator build="ab1a3707c875" version="6.3.0"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/> <link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/> <link href="/servicesNS/nobody/search/configs/conf-props/_acl" rel="_acl"/> <opensearch:totalResults>1</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> <entry> <title>myblog</title> <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myblog</id> <updated>2015-07-17T10:50:13+08:00</updated> <link href="/servicesNS/nobody/search/configs/conf-props/myblog" rel="alternate"/> <author> <name>admin</name> </author> <link href="/servicesNS/nobody/search/configs/conf-props/myblog" rel="list"/> <link href="/servicesNS/nobody/search/configs/conf-props/myblog/_reload" rel="_reload"/> <link href="/servicesNS/nobody/search/configs/conf-props/myblog" rel="edit"/> <link href="/servicesNS/nobody/search/configs/conf-props/myblog" rel="remove"/> <link href="/servicesNS/nobody/search/configs/conf-props/myblog/move" rel="move"/> <link href="/servicesNS/nobody/search/configs/conf-props/myblog/disable" rel="disable"/> <content type="text/xml"> <s:dict> <s:key name="ANNOTATE_PUNCT">1</s:key> <s:key name="AUTO_KV_JSON">1</s:key> <s:key name="BREAK_ONLY_BEFORE"></s:key> <s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key> <s:key name="CHARSET">UTF-8</s:key> <s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key> <s:key name="HEADER_MODE"></s:key> <s:key name="LEARN_SOURCETYPE">1</s:key> <s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key> <s:key name="MAX_DAYS_AGO">2000</s:key> <s:key name="MAX_DAYS_HENCE">2</s:key> <s:key name="MAX_DIFF_SECS_AGO">3600</s:key> <s:key name="MAX_DIFF_SECS_HENCE">604800</s:key> <s:key name="MAX_EVENTS">256</s:key> <s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key> <s:key name="MUST_BREAK_AFTER"></s:key> <s:key name="MUST_NOT_BREAK_AFTER"></s:key> <s:key name="MUST_NOT_BREAK_BEFORE"></s:key> <s:key name="SEGMENTATION">indexing</s:key> <s:key name="SEGMENTATION-all">full</s:key> <s:key name="SEGMENTATION-inner">inner</s:key> <s:key name="SEGMENTATION-outer">outer</s:key> <s:key name="SEGMENTATION-raw">none</s:key> <s:key name="SEGMENTATION-standard">standard</s:key> <s:key name="SHOULD_LINEMERGE">1</s:key> <s:key name="TRANSFORMS"></s:key> <s:key name="TRUNCATE">10000</s:key> <s:key name="detect_trailing_nulls">0</s:key> <s:key name="disabled">0</s:key> <s:key name="eai:acl"> <s:dict> <s:key name="app">search</s:key> <s:key name="can_change_perms">1</s:key> <s:key name="can_list">1</s:key> <s:key name="can_share_app">1</s:key> <s:key name="can_share_global">1</s:key> <s:key name="can_share_user">1</s:key> <s:key name="can_write">1</s:key> <s:key name="modifiable">1</s:key> <s:key name="owner">admin</s:key> <s:key name="perms"> <s:dict> <s:key name="read"> <s:list> <s:item>*</s:item> </s:list> </s:key> <s:key name="write"> <s:list> <s:item>admin</s:item> <s:item>power</s:item> </s:list> </s:key> </s:dict> </s:key> <s:key name="removable">1</s:key> <s:key name="sharing">global</s:key> </s:dict> </s:key> <s:key name="eai:appName">search</s:key> <s:key name="eai:userName">nobody</s:key> <s:key name="maxDist">100</s:key> <s:key name="priority"></s:key> <s:key name="sourcetype"></s:key> </s:dict> </content> </entry> </feed>
configs/conf-{file}/{stanza} DELETE
XML
XML Request
curl -k -u admin:pass --request DELETE https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs
XML Response
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/" xmlns:s="http://dev.splunk.com/ns/rest"> <title>conf-props</title> <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id> <updated>2011-07-08T01:01:27-07:00</updated> <generator version="102807"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/> <link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/> <!-- opensearch nodes elided for brevity. --> <s:messages/> </feed>
configs/conf-{file}/{stanza} GET
XML
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message
XML Response
. . . <title>conf-eventtypes</title> <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-eventtypes</id> <updated>2014-07-01T13:08:45-07:00</updated> <generator build="200839" version="6.1"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/_new" rel="create"/> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/_reload" rel="_reload"/> <opensearch:totalResults>1</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> <entry> <title>splunkd_message</title> <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message</id> <updated>2014-07-01T13:08:45-07:00</updated> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message" rel="alternate"/> <author> <name>admin</name> </author> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message" rel="list"/> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message/_reload" rel="_reload"/> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message" rel="edit"/> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message" rel="remove"/> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message/move" rel="move"/> <link href="/servicesNS/nobody/search/configs/conf-eventtypes/splunkd_message/disable" rel="disable"/> <content type="text/xml"> <s:dict> <s:key name="CHARSET">UTF-8</s:key> <s:key name="description"></s:key> <s:key name="disabled">0</s:key> <s:key name="eai:acl"> <s:dict> <s:key name="app">search</s:key> <s:key name="can_change_perms">1</s:key> <s:key name="can_list">1</s:key> <s:key name="can_share_app">1</s:key> <s:key name="can_share_global">1</s:key> <s:key name="can_share_user">1</s:key> <s:key name="can_write">1</s:key> <s:key name="modifiable">1</s:key> <s:key name="owner">admin</s:key> <s:key name="perms"> <s:dict> <s:key name="read"> <s:list> <s:item>*</s:item> </s:list> </s:key> <s:key name="write"> <s:list> <s:item>admin</s:item> <s:item>power</s:item> </s:list> </s:key> </s:dict> </s:key> <s:key name="removable">1</s:key> <s:key name="sharing">global</s:key> </s:dict> </s:key> <s:key name="eai:appName">search</s:key> <s:key name="eai:attributes"> <s:dict> <s:key name="optionalFields"> <s:list/> </s:key> <s:key name="requiredFields"> <s:list/> </s:key> <s:key name="wildcardFields"> <s:list> <s:item>.*</s:item> </s:list> </s:key> </s:dict> </s:key> <s:key name="eai:userName">nobody</s:key> <s:key name="priority">1</s:key> <s:key name="search"></s:key> <s:key name="tags"></s:key> </s:dict> </content> </entry>
configs/conf-{file}/{stanza} POST
XML
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs -d SHOULD_LINEMERGE=true
XML Response
. . . <title>conf-props</title> <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props</id> <updated>2011-07-08T01:01:26-07:00</updated> <generator version="102807"/> <author> <name>Splunk</name> </author> <link href="/servicesNS/nobody/search/configs/conf-props/_new" rel="create"/> <link href="/servicesNS/nobody/search/configs/conf-props/_reload" rel="_reload"/> <!-- opensearch nodes elided for brevity. --> <s:messages/> <entry> <title>myweblogs</title> <id>https://localhost:8089/servicesNS/nobody/search/configs/conf-props/myweblogs</id> <updated>2011-07-08T01:01:26-07:00</updated> <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="alternate"/> <author> <name>admin</name> </author> <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="list"/> <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/_reload" rel="_reload"/> <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="edit"/> <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs" rel="remove"/> <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/move" rel="move"/> <link href="/servicesNS/nobody/search/configs/conf-props/myweblogs/disable" rel="disable"/> <content type="text/xml"> <s:dict> <s:key name="ANNOTATE_PUNCT">1</s:key> <s:key name="BREAK_ONLY_BEFORE"/> <s:key name="BREAK_ONLY_BEFORE_DATE">1</s:key> <s:key name="CHARSET">UTF-8</s:key> <s:key name="DATETIME_CONFIG">/etc/datetime.xml</s:key> <s:key name="HEADER_MODE"/> <s:key name="LEARN_SOURCETYPE">1</s:key> <s:key name="LINE_BREAKER_LOOKBEHIND">100</s:key> <s:key name="MAX_DAYS_AGO">2000</s:key> <s:key name="MAX_DAYS_HENCE">2</s:key> <s:key name="MAX_DIFF_SECS_AGO">3600</s:key> <s:key name="MAX_DIFF_SECS_HENCE">604800</s:key> <s:key name="MAX_EVENTS">256</s:key> <s:key name="MAX_TIMESTAMP_LOOKAHEAD">128</s:key> <s:key name="MUST_BREAK_AFTER"/> <s:key name="MUST_NOT_BREAK_AFTER"/> <s:key name="MUST_NOT_BREAK_BEFORE"/> <s:key name="SEGMENTATION">indexing</s:key> <s:key name="SEGMENTATION-all">full</s:key> <s:key name="SEGMENTATION-inner">inner</s:key> <s:key name="SEGMENTATION-outer">outer</s:key> <s:key name="SEGMENTATION-raw">none</s:key> <s:key name="SEGMENTATION-standard">standard</s:key> <s:key name="SHOULD_LINEMERGE">1</s:key> <s:key name="TRANSFORMS"/> <s:key name="TRUNCATE">10000</s:key> <s:key name="disabled">0</s:key> <!-- eai:acl nodes elided for brevity. --> <s:key name="eai:appName">search</s:key> <s:key name="eai:userName">admin</s:key> <s:key name="maxDist">100</s:key> </s:dict> </content> </entry>
properties GET
XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/properties
XML Response
. . . <title>properties</title> <id>https://localhost:8089/services/properties</id> <updated>2014-07-01T13:17:36-07:00</updated> <generator build="200839" version="6.1"/> <author> <name>Splunk</name> </author> <entry> <title>alert_actions</title> <id>https://localhost:8089/services/properties/alert_actions</id> <updated>2014-07-01T13:17:36-07:00</updated> <link href="/services/properties/alert_actions" rel="alternate"/> </entry> <entry> <title>app</title> <id>https://localhost:8089/services/properties/app</id> <updated>2014-07-01T13:17:36-07:00</updated> <link href="/services/properties/app" rel="alternate"/> </entry> <entry> <title>audit</title> <id>https://localhost:8089/services/properties/audit</id> <updated>2014-07-01T13:17:36-07:00</updated> <link href="/services/properties/audit" rel="alternate"/> </entry> . . . elided . . . <entry> <title>viewstates</title> <id>https://localhost:8089/services/properties/viewstates</id> <updated>2014-07-01T13:17:36-07:00</updated> <link href="/services/properties/viewstates" rel="alternate"/> </entry> <entry> <title>web</title> <id>https://localhost:8089/services/properties/web</id> <updated>2014-07-01T13:17:36-07:00</updated> <link href="/services/properties/web" rel="alternate"/> </entry> <entry> <title>workflow_actions</title> <id>https://localhost:8089/services/properties/workflow_actions</id> <updated>2014-07-01T13:17:36-07:00</updated> <link href="/services/properties/workflow_actions" rel="alternate"/> </entry>
properties POST
XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/properties -d __conf=myAppConfigFile
XML Response
No response body.
Returns: HTTP status = 201 (created)
properties/{file} GET
XML
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/properties/eventtypes
XML Response
. . . <title>eventtypes</title> <id>https://localhost:8089/servicesNS/nobody/search/properties/eventtypes</id> <updated>2014-07-17T10:24:53-07:00</updated> <generator build="200839" version="6.1"/> <author> <name>Splunk</name> </author> <entry> <title>default</title> <id>https://localhost:8089/servicesNS/nobody/search/properties/eventtypes/default</id> <updated>2014-07-17T10:24:53-07:00</updated> <link href="/servicesNS/nobody/search/properties/eventtypes/default" rel="alternate"/> </entry> <entry> <title>internal_search_terms</title> <id>https://localhost:8089/servicesNS/nobody/search/properties/eventtypes/internal_search_terms</id> <updated>2014-07-17T10:24:53-07:00</updated> <link href="/servicesNS/nobody/search/properties/eventtypes/internal_search_terms" rel="alternate"/> </entry> <entry> <title>proxylogs</title> <id>https://localhost:8089/servicesNS/nobody/search/properties/eventtypes/proxylogs</id> <updated>2014-07-17T10:24:53-07:00</updated> <link href="/servicesNS/nobody/search/properties/eventtypes/proxylogs" rel="alternate"/> </entry> <entry> <title>splunkd-access</title> <id>https://localhost:8089/servicesNS/nobody/search/properties/eventtypes/splunkd-access</id> <updated>2014-07-17T10:24:53-07:00</updated> <link href="/servicesNS/nobody/search/properties/eventtypes/splunkd-access" rel="alternate"/> </entry> <entry> <title>splunkd-log</title> <id>https://localhost:8089/servicesNS/nobody/search/properties/eventtypes/splunkd-log</id> <updated>2014-07-17T10:24:53-07:00</updated> <link href="/servicesNS/nobody/search/properties/eventtypes/splunkd-log" rel="alternate"/> </entry> <entry> <title>splunkd_message</title> <id>https://localhost:8089/servicesNS/nobody/search/properties/eventtypes/splunkd_message</id> <updated>2014-07-17T10:24:53-07:00</updated> <link href="/servicesNS/nobody/search/properties/eventtypes/splunkd_message" rel="alternate"/> </entry> </feed>
properties/{file} POST
XML
XML Request
curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/search/properties/eventtypes -d __stanza=proxylogs
XML Response
No data returned in body.
Returns: HTTP status 201 (created)
properties/{file}/{stanza} GET
XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs
XML Response
. . . <title>proxylogs</title> <id>https://localhost:8089/services/properties/props/proxylogs</id> <updated>2011-07-08T12:08:52-07:00</updated> <generator version="102807"/> <author> <name>Splunk</name> </author> <entry> <title>ANNOTATE_PUNCT</title> <id>https://localhost:8089/services/properties/props/proxylogs/ANNOTATE_PUNCT</id> <updated>2011-07-08T12:08:52-07:00</updated> <link href="/services/properties/props/proxylogs/ANNOTATE_PUNCT" rel="alternate"/> <content type="text">True</content> </entry> <entry> <title>BREAK_ONLY_BEFORE</title> <id>https://localhost:8089/services/properties/props/proxylogs/BREAK_ONLY_BEFORE</id> <updated>2011-07-08T12:08:52-07:00</updated> <link href="/services/properties/props/proxylogs/BREAK_ONLY_BEFORE" rel="alternate"/> <content type="text"/> </entry> <entry> <title>BREAK_ONLY_BEFORE_DATE</title> <id>https://localhost:8089/services/properties/props/proxylogs/BREAK_ONLY_BEFORE_DATE</id> <updated>2011-07-08T12:08:52-07:00</updated> <link href="/services/properties/props/proxylogs/BREAK_ONLY_BEFORE_DATE" rel="alternate"/> <content type="text">True</content> </entry> . . . elided . . . <entry> <title>TRANSFORMS</title> <id>https://localhost:8089/services/properties/props/proxylogs/TRANSFORMS</id> <updated>2011-07-08T12:08:52-07:00</updated> <link href="/services/properties/props/proxylogs/TRANSFORMS" rel="alternate"/> <content type="text"/> </entry> <entry> <title>TRUNCATE</title> <id>https://localhost:8089/services/properties/props/proxylogs/TRUNCATE</id> <updated>2011-07-08T12:08:52-07:00</updated> <link href="/services/properties/props/proxylogs/TRUNCATE" rel="alternate"/> <content type="text">10000</content> </entry> <entry> <title>maxDist</title> <id>https://localhost:8089/services/properties/props/proxylogs/maxDist</id> <updated>2011-07-08T12:08:52-07:00</updated> <link href="/services/properties/props/proxylogs/maxDist" rel="alternate"/> <content type="text">100</content> </entry>
properties/{file}/{stanza} POST
XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs -d NO_BINARY_CHECK=true -d CHARSET=UTF-8
XML Response
<response> <messages> <msg type="INFO">Successfully modified 2 key(s)</msg> </messages> </response>
properties/{file}/{stanza}/{key} GET
XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE
XML Response
Returns: True
properties/{file}/{stanza}/{key} POST
XML
XML Request
curl -k -u admin:pass https://localhost:8089/services/properties/props/proxylogs/SHOULD_LINEMERGE -d value=false
XML Response
<response> <messages> <msg type="INFO">Successfully modified 1 key(s)</msg> </messages> </response>
PREVIOUS Configuration endpoint descriptions |
NEXT Deployment endpoint descriptions |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10
Feedback submitted, thanks!