Deployment endpoint descriptions

Manage deployment servers and clients.

A deployment server configures a deployment client. Deployment clients and servers can reside on separate, distributed, Splunk platform instances or can reside on the same instance.

• Note: Username and password authentication is required for most endpoints and REST operations. Additional capability or role-based authorization may also be required, particularly for POST or DELETE operations.

deployment/client

https://<host>:<mPort>/services/deployment/client

Description

List deployment client configuration and status.

Method summary

Method	Description	Formats
GET	Get deployment client list with enabled status, server class, and host and port number of each.	XML, JSON

---

GET deployment/client method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

For each deployment client:

Name	Description
disabled	Disabled status: 0 = Enabled 1 = Disabled
serverClasses	List of member server classes for app download authorization.
targetUri	Host and port number (<host>:<port>).

[ Top ]

deployment/client/config

https://<host>:<mPort>/services/deployment/client/config

Description

Get deployment client configuration and status.

Method summary

Method	Description	Formats
GET	Get deployment client enabled status, server class for app distribution, and host and port number.	XML, JSON

---

GET deployment/client/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
disabled	Disabled status: 0 = Enabled 1 = Disabled
serverClasses	List of member server classes for app download authorization.
targetUri	Host and port number (<host>:<port>).

[ Top ]

deployment/client/config/listIsDisabled

https://<host>:<mPort>/services/deployment/client/config/listIsDisabled

Description

Get deployment client status.

Method summary

Method	Description	Formats
GET	Get deployment client disabled status.	XML, JSON

---

GET deployment/client/config/listIsDisabled method detail

Example

Request parameters

None

Response data keys

Name	Description
disabled	Disabled status: 0 = Enabled 1 = Disabled

[ Top ]

---

deployment/client/config/reload

Description

Access information on reloading the named client.

Method summary

Method	Description	Formats
POST	Access client reload information	XML, JSON

POST deployment/client/config/reload

Example

Request parameters

No parameters for this request.

Response keys

Status Code	Description
200	Endpoint returned successfully.
400	Request error. See response body for details.
401	Authentication failure: must pass valid credentials with request.
403	Insufficient permissions to access resource.
404	Specified resoruce does not exist.
409	Request error: this operation is invalid for this item. See response body for details.
500	Internal server error. See response body for details.

---

deployment/client/{name}/reload

https://<host>:<mPort>/services/deployment/client/{name}/reload

Description

Restart and reload {name} deployment client.

Method summary

Method	Description	Formats
POST	Restart {name} deployment client and reload configuration from disk.	XML, JSON

---

POST deployment/client/{name}/reload method detail

Example

Request parameters

None

Response data keys

Name	Description
disabled	Disabled status: 0 = Enabled 1 = Disabled
serverClasses	List of member server classes for app download authorization.
targetUri	Host and port number (<host>:<port>).

[ Top ]

deployment/server/applications

https://<host>:<mPort>/services/deployment/server/applications

Description

Selectively list distributed apps.

Method summary

Method	Description	Formats
GET	Selectively list distributed apps, including distributed state information.	XML, JSON

---

GET deployment/server/applications method detail

Example

Request parameters

Name	Type	Default	Description
clientId	String		Select apps that match clientId.
hasDeploymentError	Boolean		Select apps according to deployment fault status: 0 = Do not include apps with a deployment fault indication. 1 = Include apps with a deployment fault indication.

Pagination and filtering parameters can be used with this method.

Response data keys

For each app listed:

Name	Description
archive	Disk location of the archived version of the app.
clientId	Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes.
hasDeploymentError	Indicates deployment fault status on at least one deployment client: 0 = Do not include apps with a deployment fault indication. 1 = Include apps with a deployment fault indication.
loadtime	Last deployment server app loaded or reloaded date and time.
restartSplunkWeb	Restart Splunk Web indication: 0 = Do not restart Splunk Web. 1 = Restart Splunk Web.
restartSplunkd	Restart splunkd indication: 0 = Do not restart splunkd. 1 = Restart splunkd.
serverclasses	List of server classes associated with the application.
size	Size on disk of the compressed app (bundle), in bytes.
stateOnClient	App enablement status: 0 = Not enabled. 1 = Enabled.

Application usage

An application not mapped to serverclasses is not loaded so loadtime is 0.

[ Top ]

deployment/server/applications/{name}

https://<host>:<mPort>/services/deployment/server/applications/{name}

Description

Get or update distribution information for {name} app.

Method summary

Method	Description	Formats
GET	Get {name} app distribution information.	XML, JSON
POST	Update {name} app distribution information.	XML, JSON

---

GET deployment/server/applications/{name} method detail

Example

Request parameters

None

Response data keys

Name	Description
Attribute	Description
archive	Disk location of archived version of the app.
clientId	Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes.
hasDeploymentError	Indicates deployment fault status on at least one deployment client: 0 = Do not include apps with a deployment fault indication. 1 = Include apps with a deployment fault indication.
loadtime	Last deployment server app loaded or reloaded date and time.
restartSplunkWeb	Restart Splunk Web indication: 0 = Do not restart Splunk Web. 1 = Restart Splunk Web.
restartSplunkd	Restart splunkd indication: 0 = Do not restart splunkd. 1 = Restart splunkd.
serverclasses	List of server classes associated with the application.
size	Size on disk of the compressed app (bundle), in bytes.
stateOnClient	App enablement status: 0 = Not enabled. 1 = Enabled.

Application usage

An application not mapped to serverclasses is not loaded so loadtime is 0.

---

POST deployment/server/applications/{name} method detail

Example

Request parameters

Name	Type	Default	Description
blacklist.*	String		List of hosts to exclude when mapping application to a server class. For each blacklist, replace the wildcard (*) with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.
continueMatching	Boolean		Configuration layering indication, across classes and server-specific settings: true = [Default] Configuration lookups continue matching server classes after the first match. false = Use the first match, only.
deinstall	Boolean		Remove mapping indication: true = Remove mapping of {name} from all server classes and delete it from client target repositories. false = Do not remove mapping of {name}.
filterType	Enum		Filter execution order: whitelist = Whitelist filters are applied before blacklist filters. blacklist = Blacklist filters are applied before whitelist filters.
machineTypesFilter	String		Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters. Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included. Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter. The patterns are PCRE regular expressions, with the following aids for easier entry: You can specify '.' to mean '\\.' You can specify '*' to mean '.*' Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation	String		The location on the deployment server to store the content that is to be deployed for this server class. For example: $SPLUNK_HOME/etc/deployment-apps
restartSplunkWeb	Boolean		Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated. Defaults to false
restartSplunkd	Boolean		Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated. Defaults to false
serverclass	String		The name of the server class to which the application is mapped. Do not specify this parameter if deinstall is true.
stateOnClient	Enum		Valid values are (enabled | disabled | noop). enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server. disabled: Sets the application state to disabled on the client, regardless of state on the deployment server. noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation	String		The location on the deployment client to install the apps defined for this Deployment Server. If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk Enterprise instance) Useful only with complex (for example, tiered) deployment strategies.
tmpFolder	String		Working folder used by deployment server. Defaults to $SPLUNK_HOME/var/run/tmp
unmap	Boolean		Indicates whether to remove the mapping of the application to the specified server class.
whitelist.*	String		List of hosts to accept for this server class. For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.

Response data keys

Name	Description
archive	Specifies the location of the compressed version (bundle) of the app.
blacklist.*	Regular expressions used to exclude, when mapping this application to a client. If a client matches any of the blacklist regular expressions, it does not receive the application. The * is replaced by an integral ordinal number.
continueMatching	If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used.
filterType	blacklist) Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. See description for the filterType POST parameter for more information.
loadtime	Specifies the date and time the application was last loaded (or reloaded) by the deployment server. An application not mapped to any serverclasses does not get loaded, thus its loadtime attribute is 0; in epoch terms, which is 01 Jan 1970 at midnight GMT.
machineTypesFilter	List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryLocation	The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb	Indicates whether to restart Splunk Web.
restartSplunkd	Indicates whether to restart splunkd.
serverclass	The name of the server class to which the application is mapped.
serverclasses	List of server classes associated with the application.
size	Indicates in bytes the size on disk of the compressed version (bundle) of the application.
stateOnClient	Specifies whether the deployment client is enabled or disabled.
targetRepositoryLocation	The location on the deployment client to install the apps defined for this Deployment Server. If unset, or set to empty, the repositoryLocation path is used.
tmpFolder	Working folder used by deployment server.
whitelist.*	Regular expressions used to accept, when mapping this application to a client. If a client matches any of the whitelist regular expressions, it accepts the application. The * is replaced by an integral ordinal number.

Application usage

When continueMatching is true, matching is in the order in which server classes are defined.

The whitelist setting indicates a filtering strategy that includes a subset:

• Items are not considered to match the server class by default.
• Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
• Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.

The blacklist setting indicates a filtering strategy that excludes a subset:

• Items are considered to match the server class by default.
• Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
• Items that match any whitelist entry are considered to match the server class.

That is,

whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable

If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.

[ Top ]

deployment/server/clients

https://<host>:<mPort>/services/deployment/server/clients

Description

Provides access to information about clients to a deployment server.

Method summary

Method	Description	Formats
GET	Lists information about clients to a deployment server.	XML, JSON

---

GET deployment/server/clients method detail

Example

Request parameters

Name	Type	Default	Description
action	String		Use one of the following accepted values: unknown, download, install, uninstall. Depending on the action specified, the endpoint returns all clients with an app that has the specified action.
application	String		Lists clients to the deployment server that have attempted to download the named application.
hasDeploymentError	Boolean	False	Indicates whether to list only clients that have a deployment error.
maxPhonehome_latency_to_avgInterval_ratio	Number		List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter.
minLatestPhonehomeTime	Number		Lists clients for which there is a phone home message at the specified time or later, in epoch seconds. That is, list the client for the following condition:   client latency ? (now?minLatestPhonehomeTime)
minPhonehome_latency_to_avgInterval_ratio	Number		List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses	String		Comma-separated list of serverclasses. List clients that are configured to receive an application to a listed serverclass. The match is a logical OR of, for each Si, include C if C is sent an app A that maps to Si in serverclass.conf, if such an app existed. The "would have" is per blacklist.n or whitelist.n/machineTypesFilter in serverclass.conf

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
applications	List of applications deployed to the deployment client.
averagePhoneHomeInterval	The average phone home interval, in seconds.
build	The build number for the instance of Splunk Enterprise on the deployment client.
dns	The DNS lookup name of the deployment client server.
guid	Identifier for the deployment server client.
hasDeploymentError	Specifies whether to check for clients with a deployment error.
hostname	The host name of the deployment client server.
id	ID for the client based on client name and IP address.
ip	The IP address of the client to the deployment server.
lastPhoneHomeTime	The last time the deployment client phones home to the deployment server, in epoch time.
mgmt	The managment port for the deployment client.
minLatestPhonehomeTime	Specifies in epoch seconds the minimum latency for a client to contact the deployment server.
minPhonehome_latency_to_avgInterval_ratio	The minimum value specified for the ratio of the phone home latency to the average phone home interval.
name	The name of the deployment client server.
serverclasses	List of server classes for the deployment client.
utsname	Machine type for the deployment server client.

[ Top ]

deployment/server/clients/countClients_by_machineType

https://<host>:<mPort>/services/deployment/server/clients/countClients_by_machineType

Description

Access information about deployment clients to this server according to the machine type of the client.

Method summary

Method	Description	Formats
GET	Lists the count of deployment clients to this server by machine type.	XML, JSON

---

GET deployment/server/clients/countClients_by_machineType method detail

Example

Request parameters

None

Response data keys

Name	Description
counts	The list of machine types for this deployment client, showing the count of each machine type.

[ Top ]

deployment/server/clients/countRecentDownloads

https://<host>:<mPort>/services/deployment/server/clients/countRecentDownloads

Description

Access the count of the number of downloads from this client to the deployment server during the last specified time period.

Method summary

Method	Description	Formats
GET	Return the count of the number of downloads from this client to the deployment server during the last specified time period.	XML, JSON

---

GET deployment/server/clients/countRecentDownloads method detail

Example

Request parameters

Name	Type	Default	Description
application	String		Count the number of downloads for clients that have attempted to download the named application.
hasDeploymentError	Boolean		Indicates whether to count downloads for clients that have a deployment error.
maxAgeSecs required	Number		Age of the downloads to count, in seconds.
maxPhonehome_latency_to_avgInterval_ratio	Number		List the count of recent download by this client to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter
minLatestPhonehomeTime	Number		Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists the number of downloads for clients to the deployment server with a latency equal to or greater than specified by this parameter.
minPhonehome_latency_to_avgInterval_ratio	Number		List the number of recent downloads by clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses	String		Comma-separated list of server classes. Lists the number of recent downloads by clients to the deployment server that are configured to send an application to a listed serverclass.

Response data keys

Name	Description
count	The number of recent downloads.

[ Top ]

deployment/server/clients/{name}

https://<host>:<mPort>/services/deployment/server/clients/{name}

Description

Get client information or remove a client.

Method summary

Method	Description	Formats
DELETE	Removes the specified client from the deployment server registry. The next time the client "phones home" the record is re-created.	XML, JSON
GET	Lists information about the named client to the deployment server.	XML, JSON

---

DELETE deployment/server/clients/{name} method detail

Example

Request parameters

None

Response data keys

None

---

GET deployment/server/clients/{name} method detail

Example

Request parameters

Name	Type	Default	Description
application	String		Lists information about this client with respect to the named application.
hasDeploymentError	Boolean		Indicates whether to list this client if has a deployment error.
maxPhonehome_latency_to_avgInterval_ratio	Number		List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter.
minLatestPhonehomeTime	Number		Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists information about the named client if it has a latency equal to or greater than specified by this parameter.
minPhonehome_latency_to_avgInterval_ratio	Number		List information about the named client to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter.
serverclasses	String		Comma-separated list of serverclasses. Lists information about this client if it is configured to send an application to a listed serverclass.

Response data keys

Name	Description
application	The name of the application specified to filter the results of this call.
applications	List of applications deployed to the deployment client.
averagePhoneHomeInterval	The average phone home interval, in seconds.
build	The build number for the instance of Splunk Enterprise on the deployment client.
dns	The DNS lookup name of the deployment client server.
guid	Identifier for the deployment server client.
hasDeploymentError	Specifies whether to check for clients with a deployment error.
hostname	The host name of the deployment client server.
id	ID for the client based on client name and IP address.
ip	The IP address of the client to the deployment server.
lastPhoneHomeTime	The last time the deployment client phones home to the deployment server, in epoch time.
maxPhonehome_latency_to_avgInterval_ratio	The maximum value specified for the ratio of the phone home latency to the average phone home interval.
mgmt	The managment port for the deployment client.
minLatestPhonehomeTime	Specifies in epoch seconds the minimum latency for a client to contact the deployment server.
minPhonehome_latency_to_avgInterval_ratio	The minimum value specified for the ratio of the phone home latency to the average phone home interval.
name	The name of the deployment client server.
serverClasses	The list of server classes to which the client belongs.
serverclasses	List of server classes for the deployment client.
utsname	Machine type for the deployment server client.

[ Top ]

deployment/server/config

https://<host>:<mPort>/services/deployment/server/config

Description

Access server configuration information for deployment servers.

Method summary

Method	Description	Formats
GET	List configuration information for all deployment servers.	XML, JSON

---

GET deployment/server/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
currentDownloads	The number of current downloads for this deployment server.
disabled	Indicates whether the deployment server is disabled.
loadTime	The time, in epoch seconds, the serverclass for this server was loaded.
repositoryLocation	The location on the deployment server to store the content that is to be deployed.
whitelist.0	Lists the contents of whitelist.0.

[ Top ]

deployment/server/config/attributesUnsupportedInUI

https://<host>:<mPort>/services/deployment/server/config/attributesUnsupportedInUI

Description

Access deployment server attriutes that cannot be configured from Splunk Web.

Method summary

Method	Description	Formats
GET	Lists deployment server attributes that cannot be configured from Splunk Web.	XML, JSON

---

GET deployment/server/config/attributesUnsupportedInUI method detail

Example

Request parameters

None

Response data keys

Name	Description
property	The attribute that cannot be configured from Splunk Web.
reason	The reason an attribute cannot be configured from Splunk Web.
stanza	The stanza in serverclass.conf that lists deployment server attributes that cannot be configured from Splunk Web.

[ Top ]

deployment/server/config/listIsDisabled

https://<host>:<mPort>/services/deployment/server/config/listIsDisabled

Description

Access information as to whether the deployment server is enabled.

Method summary

Method	Description	Formats
GET	List whether the deployment server is disabled.	XML, JSON

---

GET deployment/server/config/listIsDisabled method detail

Example

Request parameters

None

Response data keys

Name	Description
disabled	Indicates if the deployment server is disabled.

[ Top ]

deployment/server/serverclasses

https://<host>:<mPort>/services/deployment/server/serverclasses

Description

Access information about server classes.

Method summary

Method	Description	Formats
GET	List server classes for this deployment server.	XML, JSON
POST	Creates a server class.	XML, JSON

---

GET deployment/server/serverclasses method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
blacklist-size	The number of entires in the blacklist for this serverclass.
clientId	ID of deployment client for this server class.
currentDownloads	Number of applications currently downloaded.
hasDeploymentError	Indicates whether the serverclass has at least one deployment error.
loadTime	The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter	List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList	List of applications stored at the location specified by repositoryLocation.
repositoryLocation	The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb	Indicates whether to restart Splunk Web.
restartSplunkd	Indicates whether to restart splunkd.
stateOnClient	Indicates whether this server class is enabled or disabled.
whitelist-size	Specifies the number of entries in the whitelist for this server class.
whitelist.0	List of servers for whitelist.0 for this server class.

---

POST deployment/server/serverclasses method detail

Example

Request parameters

Name	Type	Default	Description
name required	String		The name of the server class.
blacklist.*	String		List of hosts to exclude for this server class. For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.
continueMatching	Boolen		Controls how configuration is layered across classes and server-specific settings. If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true. A serverClass can override this property and stop the matching.
filterType	Enum		Valid values: (whitelist | blacklist) Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. The whitelist setting indicates a filtering strategy that pulls in a subset: Items are not considered to match the server class by default. Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class. Items that match any blacklist entry are not considered to match the server class, regardless of whitelist. The blacklist setting indicates a filtering strategy that rules out a subset: Items are considered to match the server class by default. Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class. Items that match any whitelist entry are considered to match the server class. More briefly: whitelist: default no-match -> whitelists enable -> blacklists disable blacklist: default match -> blacklists disable-> whitelists enable If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.
machineTypesFilter	String		Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters. Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included. Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter. The patterns are PCRE regular expressions, with the following aids for easier entry: You can specify '.' to mean '\\.' You can specify '*' to mean '.*' Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation	String		The location on the deployment server to store the content that is to be deployed for this server class. For example: $SPLUNK_HOME/etc/deployment-apps
restartSplunkWeb	Boolean		Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated. Defaults to false
restartSplunkd	Boolean		Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated. Defaults to false
stateOnClient	Enum		Valid values are (enabled | disabled | noop). enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server. disabled: Sets the application state to disabled on the client, regardless of state on the deployment server. noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation	String		The location on the deployment client to install the apps defined for this Deployment Server. If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance Useful only with complex (for example, tiered) deployment strategies.
tmpFolder	String		Working folder used by deployment server. Defaults to $SPLUNK_HOME/var/run/tmp
whitelist.*	String		List of hosts to accept for this server class. For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.

Response data keys

Name	Description
blacklist-size	The number of entries in the blacklist for this serverclass.
blacklist.*	Regular expressions used to exclude for this server class. If a client matches any of the blacklist regular expressions, it is not included in the server class. The * is replaced by an integral ordinal number.
continueMatching	If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used.
currentDownloads	Number of applications currently downloaded.
filterType	blacklist) Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. See description for the filterType POST parameter for more information.
loadTime	The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter	List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList	List of applications stored at the location specified by repositoryLocation.
repositoryLocation	The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb	Indicates whether to restart Splunk Web.
restartSplunkd	Indicates whether to restart splunkd.
stateOnClient	Specifies whether the deployment client is enabled or disabled.
targetRepositoryLocation	The location on the deployment client to install the apps defined for this Deployment Server. If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk Enterprise instance. Useful only with complex (for example, tiered) deployment strategies.
tmpFolder	Working folder used by deployment server. Defaults to $SPLUNK_HOME/var/run/tmp
whitelist-size	Specifies the number of entries in the whitelist for this server class.
whitelist.*	Regular expressions used to accept for this server class. If a client matches any of the whitelist regular expressions, it is included in the server class. The * is replaced by an integral ordinal number.

[ Top ]

deployment/server/serverclasses/rename

https://<host>:<mPort>/services/deployment/server/serverclasses/rename

Description

Rename a server class.

Method summary

Method	Description	Formats
POST	Specify a new name for a server class.	XML, JSON

---

POST deployment/server/serverclasses/rename method detail

Example

Request parameters

Name	Type	Default	Description
newName required	String		The new name of the server class.
oldName required	String		The current name of the server class.

Response data keys

None

[ Top ]

deployment/server/serverclasses/{name}

https://<host>:<mPort>/services/deployment/server/serverclasses/{name}

Description

Manage the {name} serverclass.

Method summary

Method	Description	Formats
DELETE	Remove the specfied server class from this deployment server.	XML, JSON
GET	List information about the named server class.	XML, JSON
POST	Update the named server class.	XML, JSON

---

DELETE deployment/server/serverclasses/{name} method detail

Example

Request parameters

None

Response data keys

None

---

GET deployment/server/serverclasses/{name} method detail

Example

Request parameters

Name	Type	Default	Description
clientId	String		GUID of a deployment client that is a member of the named server class. Lists information about the named server class with respect to this client.
hasDeploymentError	Boolean		Indicates whether to only list server classes that have a deployment error.

Response data keys

Name	Description
blacklist-size	Specifies the size of the blacklist for the named server class.
clientId	ID of deployment client for this server class.
currentDownloads	The number of entires in the blacklist for this serverclass.
hasDeploymentError	Indicates whether the serverclass has at least one deployment error.
loadTime	The time, in epoch seconds, this serverclass was loaded.
machineTypesFilter	List of filters to be used in Boolean and logic with whitelist and blacklist filters.
repositoryList	List of applications stored at the location specified by repositoryLocation.
repositoryLocation	The location on the deployment server to store the content that is to be deployed for this server class.
restartSplunkWeb	Indicates whether to restart Splunk Web.
restartSplunkd	Indicates whether to restart splunkd.
stateOnClient	Indicates whether this server class is enabled or disabled.
whitelist-size	Specifies the number of entries in the whitelist for this server class.
whitelist.0	List of servers for whitelist.0 for this server class.

---

POST deployment/server/serverclasses/{name} method detail

Example

Request parameters

Name	Type	Default	Description
blacklist.*	String		List of hosts to exclude for this server class. For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive.
continueMatching	Boolen		Controls how configuration is layered across classes and server-specific settings. If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true. A serverClass can override this property and stop the matching.
filterType	Enum		Valid values: (whitelist | blacklist) Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. The whitelist setting indicates a filtering strategy that pulls in a subset: Items are not considered to match the server class by default. Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class. Items that match any blacklist entry are not considered to match the server class, regardless of whitelist. The blacklist setting indicates a filtering strategy that rules out a subset: Items are considered to match the server class by default. Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class. Items that match any whitelist entry are considered to match the server class. More briefly: whitelist: default no-match -> whitelists enable -> blacklists disable blacklist: default match -> blacklists disable-> whitelists enable If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.
machineTypesFilter	String		Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters. Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included. Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter. The patterns are PCRE regular expressions, with the following aids for easier entry: You can specify '.' to mean '\\.' You can specify '*' to mean '.*' Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.
repositoryLocation	String		The location on the deployment server to store the content that is to be deployed for this server class. For example: $SPLUNK_HOME/etc/deployment-apps
restartSplunkWeb	Boolean		Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated. Defaults to false
restartSplunkd	Boolean		Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated. Defaults to false
stateOnClient	Enum		Valid values are (enabled | disabled | noop). enabled: Default value. Sets the application state to enabled on the client, regardless of state on the deployment server. disabled: Sets the application state to disabled on the client, regardless of state on the deployment server. noop: The state on the client is the same as on the deployment server.
targetRepositoryLocation	String		The location on the deployment client to install the apps defined for this Deployment Server. If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance Useful only with complex (for example, tiered) deployment strategies.
tmpFolder	String		Working folder used by deployment server. Defaults to $SPLUNK_HOME/var/run/tmp
whitelist.*	String		List of hosts to accept for this server class. For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive.

Response data keys

None

[ Top ]

search/distributed/bundle-replication-files

https://<host>:<mPort>/services/search/distributed/bundle-replication-files

Description

Provide access to distributed search bundle replication files.

Method summary

Method	Description	Formats
GET	List distributed search bundle replication files.	XML, JSON

---

GET search/distributed/bundle-replication-files method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

None

[ Top ]

search/distributed/bundle-replication-files/{name}

https://<host>:<mPort>/services/search/distributed/bundle-replication-files/{name}

Description

Get {name} bundle replication file information.

Method summary

Method	Description	Formats
GET	LIst information about the specified bundle replication file. For {name}, specify the checksum for the file.	XML, JSON

---

GET search/distributed/bundle-replication-files/{name} method detail

Example

Request parameters

Name	Type	Default	Description
force_list_all	Boolean		Indicates whether to force a listing of the file.

Response data keys

None

[ Top ]

search/distributed/config

https://<host>:<mPort>/services/search/distributed/config

Description

Provides access to the Splunk Enterprise distributed search options. This option is not for adding search peers.

Method summary

Method	Description	Formats
GET	Lists the configuration options for the distributed search system.	XML, JSON

---

GET search/distributed/config method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
autoAddServers	[Deprecated]
blacklistNames	List of filenames that match the blacklist pattern, and are not replicated.
blacklistURLs	List of URLs that are blacklisted, and thus is not replicated.
checkTimedOutServersFrequency	Rechecks servers at the specified frequency (in seconds). If this is set to 0, then no recheck occurs. Defaults to 60. This attribute is ONLY relevant if removeTimedOutServers is set to true. If removeTimedOutServers is false, this attribute is ignored.
connectionTimeout	Connection timeout.
disabled	Indicates if the distributed search is disabled.
dist_search_enabled	Indicates if the distributed search is enabled.
heartbeatFrequency	[Deprecated]
heartbeatMcastAddr	[Deprecated]
heartbeatPort	[Deprecated]
receiveTimeout	Amount of time in seconds to use as a timeout while trying to read/receive data from a search peer.
removedTimedOutServers	If true, removes a server connection that cannot be made within serverTimeout. If false, every call to that server attempts to connect. This may result in a slow user interface.
sendTimeout	Send timeout.
serverTimeout	[Deprecated] Refer to connectionTimeout, sendTimeout, and receiveTimeout.
servers	The initial list of servers. If operating completely in autoAddServers mode (discovering all servers), there is no need to list any servers here.
shareBundles	Indicates whether this server uses bundle replication to share search time configuration with search peers. If set to false, the search head assumes that the search peers can access the correct bundles using an NFS share and have correctly configured the options listed under: "SEARCH HEAD BUNDLE MOUNTING OPTIONS."
skipOurselves	[Deprecated]
statusTimeout	Set connection timeout when gathering a search peer's basic info (/services/server/info). Read/write timeouts are automatically set to twice this value.
ttl	[Deprecated]

[ Top ]

search/distributed/peers

https://<host>:<mPort>/services/search/distributed/peers

Description

Provides distributed peer server management. A search peer is defined as a splunk server to which another splunk server distributes searches. The splunk server where the search request originates is referred to as the search head.

Method summary

Method	Description	Formats
GET	Returns a list of configured search peers that this search head is configured to distribute searches to. This includes configured search peers disabled.	XML, JSON

---

GET search/distributed/peers method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
build	The Splunk Enterprise build number for this peer.
bundle_versions	The IDs of the bundles (of this search head) that the peer has. The IDs are sorted from latest to earliest.
disabled	Indicates if the peer is disabled.
guid	GUID of the peer.
is_https	Inidcates if the management port is ussing SSL.
licenseSignature	The license signature.
peerName	The Splunk Enterprise server name of the peer.
peerType	Specifies whether the peer is configured or discovered.
replicationStatus	The status of bundle replication to this peer. Can be any of the following values: Initial In progress Failed Successful Mounted
status	The status of the peer. Can be one of the following values: Up Down Blacklisted Not a Splunk server Free Splunk server Authentication Failed Duplicate License Duplicate Servername Inconsistent bundles
version	The Splunk Enterprise version string this peer is running.

---

[ Top ]

search/distributed/peers/{name}

https://<host>:<mPort>/services/search/distributed/peers

Description

Provides distributed peer server management. A search peer is defined as a splunk server to which another splunk server distributes searches. The splunk server where the search request originates is referred to as the search head.

Method summary

Method	Description	Formats
POST	Returns a list of configured search peers that this search head is configured to distribute searches to. This includes configured search peers disabled.	XML, JSON

---

POST search/distributed/peers/{name} method detail

Example

Request parameters

Pagination and filtering parameters can be used with this method.

Response data keys

Name	Description
build	The Splunk Enterprise build number for this peer.
bundle_versions	The IDs of the bundles (of this search head) that the peer has. The IDs are sorted from latest to earliest.
disabled	Indicates if the peer is disabled.
guid	GUID of the peer.
is_https	Inidcates if the management port is ussing SSL.
licenseSignature	The license signature.
peerName	The Splunk Enterprise server name of the peer.
peerType	Specifies whether the peer is configured or discovered.
replicationStatus	The status of bundle replication to this peer. Can be any of the following values: Initial In progress Failed Successful Mounted
status	The status of the peer. Can be one of the following values: Up Down Blacklisted Not a Splunk server Free Splunk server Authentication Failed Duplicate License Duplicate Servername Inconsistent bundles
version	The Splunk Enterprise version string this peer is running.

---

[ Top ]