
Deployment endpoint descriptions
Manage deployment servers and clients.
A deployment server configures a deployment client. Deployment clients and servers can reside on separate, distributed, Splunk platform instances or can reside on the same instance.
- Note: Username and password authentication is required for most endpoints and REST operations. Additional capability or role-based authorization may also be required, particularly for POST or DELETE operations.
deployment/client
https://<host>:<mPort>/services/deployment/client
Description
List deployment client configuration and status.
Method summary
Method | Description | Formats |
---|---|---|
GET | Get deployment client list with enabled status, server class, and host and port number of each. | XML, JSON |
GET deployment/client
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
For each deployment client:
Name | Description |
---|---|
disabled | Disabled status: 0 = Enabled 1 = Disabled |
serverClasses | List of member server classes for app download authorization. |
targetUri | Host and port number (<host>:<port>). |
[ Top ]
deployment/client/config
https://<host>:<mPort>/services/deployment/client/config
Description
Get deployment client configuration and status.
Method summary
Method | Description | Formats |
---|---|---|
GET | Get deployment client enabled status, server class for app distribution, and host and port number. | XML, JSON |
GET deployment/client/config
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
Name | Description |
---|---|
disabled | Disabled status: 0 = Enabled 1 = Disabled |
serverClasses | List of member server classes for app download authorization. |
targetUri | Host and port number (<host>:<port>). |
[ Top ]
deployment/client/config/listIsDisabled
https://<host>:<mPort>/services/deployment/client/config/listIsDisabled
Description
Get deployment client status.
Method summary
Method | Description | Formats |
---|---|---|
GET | Get deployment client disabled status. | XML, JSON |
GET deployment/client/config/listIsDisabled
method detail
Request parameters
None
Response data keys
Name | Description |
---|---|
disabled | Disabled status: 0 = Enabled 1 = Disabled |
[ Top ]
deployment/client/config/reload
Description
Access information on reloading the named client.
Method summary
Method | Description | Formats |
---|---|---|
POST | Access client reload information | XML, JSON |
POST deployment/client/config/reload
Request parameters
No parameters for this request.
Response keys
Status Code | Description |
---|---|
200 | Endpoint returned successfully. |
400 | Request error. See response body for details. |
401 | Authentication failure: must pass valid credentials with request. |
403 | Insufficient permissions to access resource. |
404 | Specified resoruce does not exist. |
409 | Request error: this operation is invalid for this item. See response body for details. |
500 | Internal server error. See response body for details. |
deployment/client/{name}/reload
https://<host>:<mPort>/services/deployment/client/{name}/reload
Description
Restart and reload {name} deployment client.
Method summary
Method | Description | Formats |
---|---|---|
POST | Restart {name} deployment client and reload configuration from disk. | XML, JSON |
POST deployment/client/{name}/reload
method detail
Request parameters
None
Response data keys
Name | Description |
---|---|
disabled | Disabled status: 0 = Enabled 1 = Disabled |
serverClasses | List of member server classes for app download authorization. |
targetUri | Host and port number (<host>:<port>). |
[ Top ]
deployment/server/applications
https://<host>:<mPort>/services/deployment/server/applications
Description
Selectively list distributed apps.
Method summary
Method | Description | Formats |
---|---|---|
GET | Selectively list distributed apps, including distributed state information. | XML, JSON |
GET deployment/server/applications
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
clientId | String | Select apps that match clientId. | |
hasDeploymentError | Boolean | Select apps according to deployment fault status: 0 = Do not include apps with a deployment fault indication. 1 = Include apps with a deployment fault indication. |
Pagination and filtering parameters can be used with this method.
Response data keys
For each app listed:
Name | Description |
---|---|
archive | Disk location of the archived version of the app. |
clientId | Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes. |
hasDeploymentError | Indicates deployment fault status on at least one deployment client: 0 = Do not include apps with a deployment fault indication. 1 = Include apps with a deployment fault indication. |
loadtime | Last deployment server app loaded or reloaded date and time. |
restartSplunkWeb | Restart Splunk Web indication: 0 = Do not restart Splunk Web. 1 = Restart Splunk Web. |
restartSplunkd | Restart splunkd indication: 0 = Do not restart splunkd. 1 = Restart splunkd. |
serverclasses | List of server classes associated with the application. |
size | Size on disk of the compressed app (bundle), in bytes. |
stateOnClient | App enablement status: 0 = Not enabled. 1 = Enabled. |
Application usage
An application not mapped to serverclasses is not loaded so loadtime is 0.
[ Top ]
deployment/server/applications/{name}
https://<host>:<mPort>/services/deployment/server/applications/{name}
Description
Get or update distribution information for {name} app.
Method summary
Method | Description | Formats |
---|---|---|
GET | Get {name} app distribution information. | XML, JSON |
POST | Update {name} app distribution information. | XML, JSON |
GET deployment/server/applications/{name}
method detail
Request parameters
None
Response data keys
Name | Description |
---|---|
Attribute | Description |
archive | Disk location of archived version of the app. |
clientId | Deployment client ID associated with the app, an MD5 hash value of serialized (catenated) client attributes. |
hasDeploymentError | Indicates deployment fault status on at least one deployment client: 0 = Do not include apps with a deployment fault indication. 1 = Include apps with a deployment fault indication. |
loadtime | Last deployment server app loaded or reloaded date and time. |
restartSplunkWeb | Restart Splunk Web indication: 0 = Do not restart Splunk Web. 1 = Restart Splunk Web. |
restartSplunkd | Restart splunkd indication: 0 = Do not restart splunkd. 1 = Restart splunkd. |
serverclasses | List of server classes associated with the application. |
size | Size on disk of the compressed app (bundle), in bytes. |
stateOnClient | App enablement status: 0 = Not enabled. 1 = Enabled. |
Application usage
An application not mapped to serverclasses is not loaded so loadtime is 0.
POST deployment/server/applications/{name}
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
blacklist.* | String | List of hosts to exclude when mapping application to a server class. For each blacklist, replace the wildcard (*) with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive. | |
continueMatching | Boolean | Configuration layering indication, across classes and server-specific settings: true = [Default] Configuration lookups continue matching server classes after the first match. false = Use the first match, only. | |
deinstall | Boolean | Remove mapping indication: true = Remove mapping of {name} from all server classes and delete it from client target repositories. false = Do not remove mapping of {name}. | |
filterType | Enum | Filter execution order: whitelist = Whitelist filters are applied before blacklist filters. blacklist = Blacklist filters are applied before whitelist filters. | |
machineTypesFilter | String | Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.
Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included. Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter. The patterns are PCRE regular expressions, with the following aids for easier entry:
| |
repositoryLocation | String | The location on the deployment server to store the content that is to be deployed for this server class.
For example: $SPLUNK_HOME/etc/deployment-apps | |
restartSplunkWeb | Boolean | Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.
Defaults to false | |
restartSplunkd | Boolean | Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.
Defaults to false | |
serverclass | String | The name of the server class to which the application is mapped.
Do not specify this parameter if | |
stateOnClient | Enum | Valid values are (enabled | disabled | noop).
| |
targetRepositoryLocation | String | The location on the deployment client to install the apps defined for this Deployment Server.
If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk Enterprise instance) Useful only with complex (for example, tiered) deployment strategies. | |
tmpFolder | String | Working folder used by deployment server.
Defaults to $SPLUNK_HOME/var/run/tmp | |
unmap | Boolean | Indicates whether to remove the mapping of the application to the specified server class. | |
whitelist.* | String | List of hosts to accept for this server class.
For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive. |
Response data keys
Name | Description |
---|---|
archive | Specifies the location of the compressed version (bundle) of the app. |
blacklist.* | Regular expressions used to exclude, when mapping this application to a client.
If a client matches any of the blacklist regular expressions, it does not receive the application. The * is replaced by an integral ordinal number. |
continueMatching | If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. |
filterType | blacklist)
Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. See description for the filterType POST parameter for more information. |
loadtime | Specifies the date and time the application was last loaded (or reloaded) by the deployment server.
An application not mapped to any serverclasses does not get loaded, thus its loadtime attribute is 0; in epoch terms, which is 01 Jan 1970 at midnight GMT. |
machineTypesFilter | List of filters to be used in Boolean and logic with whitelist and blacklist filters. |
repositoryLocation | The location on the deployment server to store the content that is to be deployed for this server class. |
restartSplunkWeb | Indicates whether to restart Splunk Web. |
restartSplunkd | Indicates whether to restart splunkd. |
serverclass | The name of the server class to which the application is mapped. |
serverclasses | List of server classes associated with the application. |
size | Indicates in bytes the size on disk of the compressed version (bundle) of the application. |
stateOnClient | Specifies whether the deployment client is enabled or disabled. |
targetRepositoryLocation | The location on the deployment client to install the apps defined for this Deployment Server.
If unset, or set to empty, the repositoryLocation path is used. |
tmpFolder | Working folder used by deployment server. |
whitelist.* | Regular expressions used to accept, when mapping this application to a client.
If a client matches any of the whitelist regular expressions, it accepts the application. The * is replaced by an integral ordinal number. |
Application usage
When continueMatching is true, matching is in the order in which server classes are defined.
The whitelist setting indicates a filtering strategy that includes a subset:
- Items are not considered to match the server class by default.
- Items that match any whitelist entry, and do not match any blacklist entry, are considered to match the server class.
- Items that match any blacklist entry are not considered to match the server class, regardless of whitelist.
The blacklist setting indicates a filtering strategy that excludes a subset:
- Items are considered to match the server class by default.
- Items that match any blacklist entry, and do not match any whitelist entry, are considered to not match the server class.
- Items that match any whitelist entry are considered to match the server class.
That is,
whitelist: default no-match -> whitelists enable -> blacklists disable
blacklist: default match -> blacklists disable-> whitelists enable
If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode.
[ Top ]
deployment/server/clients
https://<host>:<mPort>/services/deployment/server/clients
Description
Provides access to information about clients to a deployment server.
Method summary
Method | Description | Formats |
---|---|---|
GET | Lists information about clients to a deployment server. | XML, JSON |
GET deployment/server/clients
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
action | String | Use one of the following accepted values: unknown , download , install , uninstall . Depending on the action specified, the endpoint returns all clients with an app that has the specified action.
| |
application | String | Lists clients to the deployment server that have attempted to download the named application. | |
hasDeploymentError | Boolean | False | Indicates whether to list only clients that have a deployment error. |
maxPhonehome_latency_to_avgInterval_ratio | Number | List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter. | |
minLatestPhonehomeTime | Number | Lists clients for which there is a phone home message at the specified time or later, in epoch seconds. That is, list the client for the following condition:
client latency ? (now?minLatestPhonehomeTime) | |
minPhonehome_latency_to_avgInterval_ratio | Number | List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter. | |
serverclasses | String | Comma-separated list of serverclasses. List clients that are configured to receive an application to a listed serverclass.
The match is a logical OR of, for each Si, include C if C is sent an app A that maps to Si in serverclass.conf, if such an app existed. The "would have" is per blacklist.n or whitelist.n/machineTypesFilter in serverclass.conf |
Pagination and filtering parameters can be used with this method.
Response data keys
Name | Description |
---|---|
applications | List of applications deployed to the deployment client. |
averagePhoneHomeInterval | The average phone home interval, in seconds. |
build | The build number for the instance of Splunk Enterprise on the deployment client. |
dns | The DNS lookup name of the deployment client server. |
guid | Identifier for the deployment server client. |
hasDeploymentError | Specifies whether to check for clients with a deployment error. |
hostname | The host name of the deployment client server. |
id | ID for the client based on client name and IP address. |
ip | The IP address of the client to the deployment server. |
lastPhoneHomeTime | The last time the deployment client phones home to the deployment server, in epoch time. |
mgmt | The managment port for the deployment client. |
minLatestPhonehomeTime | Specifies in epoch seconds the minimum latency for a client to contact the deployment server. |
minPhonehome_latency_to_avgInterval_ratio | The minimum value specified for the ratio of the phone home latency to the average phone home interval. |
name | The name of the deployment client server. |
serverclasses | List of server classes for the deployment client. |
utsname | Machine type for the deployment server client. |
[ Top ]
deployment/server/clients/countClients_by_machineType
https://<host>:<mPort>/services/deployment/server/clients/countClients_by_machineType
Description
Access information about deployment clients to this server according to the machine type of the client.
Method summary
Method | Description | Formats |
---|---|---|
GET | Lists the count of deployment clients to this server by machine type. | XML, JSON |
GET deployment/server/clients/countClients_by_machineType
method detail
Request parameters
None
Response data keys
Name | Description |
---|---|
counts | The list of machine types for this deployment client, showing the count of each machine type. |
[ Top ]
deployment/server/clients/countRecentDownloads
https://<host>:<mPort>/services/deployment/server/clients/countRecentDownloads
Description
Access the count of the number of downloads from this client to the deployment server during the last specified time period.
Method summary
Method | Description | Formats |
---|---|---|
GET | Return the count of the number of downloads from this client to the deployment server during the last specified time period. | XML, JSON |
GET deployment/server/clients/countRecentDownloads
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
application | String | Count the number of downloads for clients that have attempted to download the named application. | |
hasDeploymentError | Boolean | Indicates whether to count downloads for clients that have a deployment error. | |
maxAgeSecs required |
Number | Age of the downloads to count, in seconds. | |
maxPhonehome_latency_to_avgInterval_ratio | Number | List the count of recent download by this client to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter | |
minLatestPhonehomeTime | Number | Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists the number of downloads for clients to the deployment server with a latency equal to or greater than specified by this parameter. | |
minPhonehome_latency_to_avgInterval_ratio | Number | List the number of recent downloads by clients to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter. | |
serverclasses | String | Comma-separated list of server classes. Lists the number of recent downloads by clients to the deployment server that are configured to send an application to a listed serverclass. |
Response data keys
Name | Description |
---|---|
count | The number of recent downloads. |
[ Top ]
deployment/server/clients/{name}
https://<host>:<mPort>/services/deployment/server/clients/{name}
Description
Get client information or remove a client.
Method summary
Method | Description | Formats |
---|---|---|
DELETE | Removes the specified client from the deployment server registry. The next time the client "phones home" the record is re-created. | XML, JSON |
GET | Lists information about the named client to the deployment server. | XML, JSON |
DELETE deployment/server/clients/{name}
method detail
Request parameters
None
Response data keys
None
GET deployment/server/clients/{name}
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
application | String | Lists information about this client with respect to the named application. | |
hasDeploymentError | Boolean | Indicates whether to list this client if has a deployment error. | |
maxPhonehome_latency_to_avgInterval_ratio | Number | List clients to the deployment server when the ratio of the phone home latency to the average phone home interval is less than the value supplied to this parameter. | |
minLatestPhonehomeTime | Number | Specifies in epoch seconds the minimum latency for a client to contact the deployment server. This endpoint lists information about the named client if it has a latency equal to or greater than specified by this parameter. | |
minPhonehome_latency_to_avgInterval_ratio | Number | List information about the named client to the deployment server when the ratio of the phone home latency to the average phone home interval is greater than the value supplied with this parameter. | |
serverclasses | String | Comma-separated list of serverclasses. Lists information about this client if it is configured to send an application to a listed serverclass. |
Response data keys
Name | Description |
---|---|
application | The name of the application specified to filter the results of this call. |
applications | List of applications deployed to the deployment client. |
averagePhoneHomeInterval | The average phone home interval, in seconds. |
build | The build number for the instance of Splunk Enterprise on the deployment client. |
dns | The DNS lookup name of the deployment client server. |
guid | Identifier for the deployment server client. |
hasDeploymentError | Specifies whether to check for clients with a deployment error. |
hostname | The host name of the deployment client server. |
id | ID for the client based on client name and IP address. |
ip | The IP address of the client to the deployment server. |
lastPhoneHomeTime | The last time the deployment client phones home to the deployment server, in epoch time. |
maxPhonehome_latency_to_avgInterval_ratio | The maximum value specified for the ratio of the phone home latency to the average phone home interval. |
mgmt | The managment port for the deployment client. |
minLatestPhonehomeTime | Specifies in epoch seconds the minimum latency for a client to contact the deployment server. |
minPhonehome_latency_to_avgInterval_ratio | The minimum value specified for the ratio of the phone home latency to the average phone home interval. |
name | The name of the deployment client server. |
serverClasses | The list of server classes to which the client belongs. |
serverclasses | List of server classes for the deployment client. |
utsname | Machine type for the deployment server client. |
[ Top ]
deployment/server/config
https://<host>:<mPort>/services/deployment/server/config
Description
Access server configuration information for deployment servers.
Method summary
Method | Description | Formats |
---|---|---|
GET | List configuration information for all deployment servers. | XML, JSON |
GET deployment/server/config
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
Name | Description |
---|---|
currentDownloads | The number of current downloads for this deployment server. |
disabled | Indicates whether the deployment server is disabled. |
loadTime | The time, in epoch seconds, the serverclass for this server was loaded. |
repositoryLocation | The location on the deployment server to store the content that is to be deployed. |
whitelist.0 | Lists the contents of whitelist.0. |
[ Top ]
deployment/server/config/attributesUnsupportedInUI
https://<host>:<mPort>/services/deployment/server/config/attributesUnsupportedInUI
Description
Access deployment server attriutes that cannot be configured from Splunk Web.
Method summary
Method | Description | Formats |
---|---|---|
GET | Lists deployment server attributes that cannot be configured from Splunk Web. | XML, JSON |
GET deployment/server/config/attributesUnsupportedInUI
method detail
Request parameters
None
Response data keys
Name | Description |
---|---|
property | The attribute that cannot be configured from Splunk Web. |
reason | The reason an attribute cannot be configured from Splunk Web. |
stanza | The stanza in serverclass.conf that lists deployment server attributes that cannot be configured from Splunk Web. |
[ Top ]
deployment/server/config/listIsDisabled
https://<host>:<mPort>/services/deployment/server/config/listIsDisabled
Description
Access information as to whether the deployment server is enabled.
Method summary
Method | Description | Formats |
---|---|---|
GET | List whether the deployment server is disabled. | XML, JSON |
GET deployment/server/config/listIsDisabled
method detail
Request parameters
None
Response data keys
Name | Description |
---|---|
disabled | Indicates if the deployment server is disabled. |
[ Top ]
deployment/server/serverclasses
https://<host>:<mPort>/services/deployment/server/serverclasses
Description
Access information about server classes.
Method summary
Method | Description | Formats |
---|---|---|
GET | List server classes for this deployment server. | XML, JSON |
POST | Creates a server class. | XML, JSON |
GET deployment/server/serverclasses
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
Name | Description |
---|---|
blacklist-size | The number of entires in the blacklist for this serverclass. |
clientId | ID of deployment client for this server class. |
currentDownloads | Number of applications currently downloaded. |
hasDeploymentError | Indicates whether the serverclass has at least one deployment error. |
loadTime | The time, in epoch seconds, this serverclass was loaded. |
machineTypesFilter | List of filters to be used in Boolean and logic with whitelist and blacklist filters. |
repositoryList | List of applications stored at the location specified by repositoryLocation. |
repositoryLocation | The location on the deployment server to store the content that is to be deployed for this server class. |
restartSplunkWeb | Indicates whether to restart Splunk Web. |
restartSplunkd | Indicates whether to restart splunkd. |
stateOnClient | Indicates whether this server class is enabled or disabled. |
whitelist-size | Specifies the number of entries in the whitelist for this server class. |
whitelist.0 | List of servers for whitelist.0 for this server class. |
POST deployment/server/serverclasses
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
name required |
String | The name of the server class. | |
blacklist.* | String | List of hosts to exclude for this server class.
For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive. | |
continueMatching | Boolen | Controls how configuration is layered across classes and server-specific settings.
If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true. A serverClass can override this property and stop the matching. | |
filterType | Enum | Valid values: (whitelist | blacklist)
Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. The whitelist setting indicates a filtering strategy that pulls in a subset:
The blacklist setting indicates a filtering strategy that rules out a subset:
More briefly: whitelist: default no-match -> whitelists enable -> blacklists disable If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode. | |
machineTypesFilter | String | Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.
Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included. Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter. The patterns are PCRE regular expressions, with the following aids for easier entry:
| |
repositoryLocation | String | The location on the deployment server to store the content that is to be deployed for this server class.
For example: $SPLUNK_HOME/etc/deployment-apps | |
restartSplunkWeb | Boolean | Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.
Defaults to false | |
restartSplunkd | Boolean | Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.
Defaults to false | |
stateOnClient | Enum | Valid values are (enabled | disabled | noop).
| |
targetRepositoryLocation | String | The location on the deployment client to install the apps defined for this Deployment Server.
If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance Useful only with complex (for example, tiered) deployment strategies.
| |
tmpFolder | String | Working folder used by deployment server.
Defaults to $SPLUNK_HOME/var/run/tmp | |
whitelist.* | String | List of hosts to accept for this server class.
For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive. |
Response data keys
Name | Description |
---|---|
blacklist-size | The number of entries in the blacklist for this serverclass. |
blacklist.* | Regular expressions used to exclude for this server class.
If a client matches any of the blacklist regular expressions, it is not included in the server class. The * is replaced by an integral ordinal number. |
continueMatching | If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. |
currentDownloads | Number of applications currently downloaded. |
filterType | blacklist)
Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. See description for the filterType POST parameter for more information. |
loadTime | The time, in epoch seconds, this serverclass was loaded. |
machineTypesFilter | List of filters to be used in Boolean and logic with whitelist and blacklist filters. |
repositoryList | List of applications stored at the location specified by repositoryLocation. |
repositoryLocation | The location on the deployment server to store the content that is to be deployed for this server class. |
restartSplunkWeb | Indicates whether to restart Splunk Web. |
restartSplunkd | Indicates whether to restart splunkd. |
stateOnClient | Specifies whether the deployment client is enabled or disabled. |
targetRepositoryLocation | The location on the deployment client to install the apps defined for this Deployment Server.
If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk Enterprise instance. Useful only with complex (for example, tiered) deployment strategies. |
tmpFolder | Working folder used by deployment server.
Defaults to $SPLUNK_HOME/var/run/tmp |
whitelist-size | Specifies the number of entries in the whitelist for this server class. |
whitelist.* | Regular expressions used to accept for this server class.
If a client matches any of the whitelist regular expressions, it is included in the server class. The * is replaced by an integral ordinal number. |
[ Top ]
deployment/server/serverclasses/rename
https://<host>:<mPort>/services/deployment/server/serverclasses/rename
Description
Rename a server class.
Method summary
Method | Description | Formats |
---|---|---|
POST | Specify a new name for a server class. | XML, JSON |
POST deployment/server/serverclasses/rename
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
newName required |
String | The new name of the server class. | |
oldName required |
String | The current name of the server class. |
Response data keys
None
[ Top ]
deployment/server/serverclasses/{name}
https://<host>:<mPort>/services/deployment/server/serverclasses/{name}
Description
Manage the {name} serverclass.
Method summary
Method | Description | Formats |
---|---|---|
DELETE | Remove the specfied server class from this deployment server. | XML, JSON |
GET | List information about the named server class. | XML, JSON |
POST | Update the named server class. | XML, JSON |
DELETE deployment/server/serverclasses/{name}
method detail
Request parameters
None
Response data keys
None
GET deployment/server/serverclasses/{name}
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
clientId | String | GUID of a deployment client that is a member of the named server class. Lists information about the named server class with respect to this client. | |
hasDeploymentError | Boolean | Indicates whether to only list server classes that have a deployment error. |
Response data keys
Name | Description |
---|---|
blacklist-size | Specifies the size of the blacklist for the named server class. |
clientId | ID of deployment client for this server class. |
currentDownloads | The number of entires in the blacklist for this serverclass. |
hasDeploymentError | Indicates whether the serverclass has at least one deployment error. |
loadTime | The time, in epoch seconds, this serverclass was loaded. |
machineTypesFilter | List of filters to be used in Boolean and logic with whitelist and blacklist filters. |
repositoryList | List of applications stored at the location specified by repositoryLocation. |
repositoryLocation | The location on the deployment server to store the content that is to be deployed for this server class. |
restartSplunkWeb | Indicates whether to restart Splunk Web. |
restartSplunkd | Indicates whether to restart splunkd. |
stateOnClient | Indicates whether this server class is enabled or disabled. |
whitelist-size | Specifies the number of entries in the whitelist for this server class. |
whitelist.0 | List of servers for whitelist.0 for this server class. |
POST deployment/server/serverclasses/{name}
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
blacklist.* | String | List of hosts to exclude for this server class.
For each blacklist, replace * with an ordinal number to specify additional blacklists. Filter ordinals must start at 0 and be consecutive. | |
continueMatching | Boolen | Controls how configuration is layered across classes and server-specific settings.
If true, configuration lookups continue matching server classes, beyond the first match. If false, only the first match is used. Matching is done in the order that server classes are defined. Defaults to true. A serverClass can override this property and stop the matching. | |
filterType | Enum | Valid values: (whitelist | blacklist)
Determines the order of execution of filters. If filterType is whitelist, all whitelist filters are applied first, followed by blacklist filters. If filterType is blacklist, all blacklist filters are applied first, followed by whitelist filters. The whitelist setting indicates a filtering strategy that pulls in a subset:
The blacklist setting indicates a filtering strategy that rules out a subset:
More briefly: whitelist: default no-match -> whitelists enable -> blacklists disable If you specify whitelist at the global level, and then specify blacklist for an individual server class, the setting becomes blacklist for that server class, and you have to provide another filter in that server class definition to replace the one you overrode. | |
machineTypesFilter | String | Comma-separated list of filters to be used in Boolean and logic with whitelist and blacklist filters.
Only clients that match the white/blacklist filters AND that match this machineTypesFilter are included. Thus the match is an intersection of the matches for the white/blacklist and the matches for MachineTypesFilter. The patterns are PCRE regular expressions, with the following aids for easier entry:
| |
repositoryLocation | String | The location on the deployment server to store the content that is to be deployed for this server class.
For example: $SPLUNK_HOME/etc/deployment-apps | |
restartSplunkWeb | Boolean | Indicates whether to restart SplunkWeb on the client when a member app or a directly configured app is updated.
Defaults to false | |
restartSplunkd | Boolean | Indicates whether to restart splunkd on the client when a member app or a directly configured app is updated.
Defaults to false | |
stateOnClient | Enum | Valid values are (enabled | disabled | noop).
| |
targetRepositoryLocation | String | The location on the deployment client to install the apps defined for this Deployment Server.
If unset, or set to empty, the repositoryLocation path is used. That is, defaults to: $SPLUNK_HOME/etc/apps (the live configuration directory for a Splunk instance Useful only with complex (for example, tiered) deployment strategies.
| |
tmpFolder | String | Working folder used by deployment server.
Defaults to $SPLUNK_HOME/var/run/tmp | |
whitelist.* | String | List of hosts to accept for this server class.
For each whitelist, replace * with an ordinal number to specify additional whitelists. Filter ordinals must start at 0 and be consecutive. |
Response data keys
None
[ Top ]
search/distributed/bundle-replication-files
https://<host>:<mPort>/services/search/distributed/bundle-replication-files
Description
Provide access to distributed search bundle replication files.
Method summary
Method | Description | Formats |
---|---|---|
GET | List distributed search bundle replication files. | XML, JSON |
GET search/distributed/bundle-replication-files
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
None
[ Top ]
search/distributed/bundle-replication-files/{name}
https://<host>:<mPort>/services/search/distributed/bundle-replication-files/{name}
Description
Get {name} bundle replication file information.
Method summary
Method | Description | Formats |
---|---|---|
GET | LIst information about the specified bundle replication file. For {name}, specify the checksum for the file. | XML, JSON |
GET search/distributed/bundle-replication-files/{name}
method detail
Request parameters
Name | Type | Default | Description |
---|---|---|---|
force_list_all | Boolean | Indicates whether to force a listing of the file. |
Response data keys
None
[ Top ]
search/distributed/config
https://<host>:<mPort>/services/search/distributed/config
Description
Provides access to the Splunk Enterprise distributed search options. This option is not for adding search peers.
Method summary
Method | Description | Formats |
---|---|---|
GET | Lists the configuration options for the distributed search system. | XML, JSON |
GET search/distributed/config
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
Name | Description |
---|---|
autoAddServers | [Deprecated] |
blacklistNames | List of filenames that match the blacklist pattern, and are not replicated. |
blacklistURLs | List of URLs that are blacklisted, and thus is not replicated. |
checkTimedOutServersFrequency | Rechecks servers at the specified frequency (in seconds). If this is set to 0, then no recheck occurs. Defaults to 60.
This attribute is ONLY relevant if removeTimedOutServers is set to |
connectionTimeout | Connection timeout. |
disabled | Indicates if the distributed search is disabled. |
dist_search_enabled | Indicates if the distributed search is enabled. |
heartbeatFrequency | [Deprecated] |
heartbeatMcastAddr | [Deprecated] |
heartbeatPort | [Deprecated] |
receiveTimeout | Amount of time in seconds to use as a timeout while trying to read/receive data from a search peer. |
removedTimedOutServers | If true, removes a server connection that cannot be made within serverTimeout.
If false, every call to that server attempts to connect. This may result in a slow user interface. |
sendTimeout | Send timeout. |
serverTimeout | [Deprecated] Refer to connectionTimeout, sendTimeout, and receiveTimeout. |
servers | The initial list of servers.
If operating completely in autoAddServers mode (discovering all servers), there is no need to list any servers here. |
shareBundles | Indicates whether this server uses bundle replication to share search time configuration with search peers.
If set to false, the search head assumes that the search peers can access the correct bundles using an NFS share and have correctly configured the options listed under: "SEARCH HEAD BUNDLE MOUNTING OPTIONS." |
skipOurselves | [Deprecated] |
statusTimeout | Set connection timeout when gathering a search peer's basic info (/services/server/info). Read/write timeouts are automatically set to twice this value. |
ttl | [Deprecated] |
[ Top ]
search/distributed/peers
https://<host>:<mPort>/services/search/distributed/peers
Description
Provides distributed peer server management. A search peer is defined as a splunk server to which another splunk server distributes searches. The splunk server where the search request originates is referred to as the search head.
Method summary
Method | Description | Formats |
---|---|---|
GET | Returns a list of configured search peers that this search head is configured to distribute searches to. This includes configured search peers disabled. | XML, JSON |
GET search/distributed/peers
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
Name | Description |
---|---|
build | The Splunk Enterprise build number for this peer. |
bundle_versions | The IDs of the bundles (of this search head) that the peer has.
The IDs are sorted from latest to earliest. |
disabled | Indicates if the peer is disabled. |
guid | GUID of the peer. |
is_https | Inidcates if the management port is ussing SSL. |
licenseSignature | The license signature. |
peerName | The Splunk Enterprise server name of the peer. |
peerType | Specifies whether the peer is configured or discovered. |
replicationStatus | The status of bundle replication to this peer. Can be any of the following values:
|
status | The status of the peer.
Can be one of the following values:
|
version | The Splunk Enterprise version string this peer is running. |
[ Top ]
search/distributed/peers/{name}
https://<host>:<mPort>/services/search/distributed/peers
Description
Provides distributed peer server management. A search peer is defined as a splunk server to which another splunk server distributes searches. The splunk server where the search request originates is referred to as the search head.
Method summary
Method | Description | Formats |
---|---|---|
POST | Returns a list of configured search peers that this search head is configured to distribute searches to. This includes configured search peers disabled. | XML, JSON |
POST search/distributed/peers/{name}
method detail
Request parameters
Pagination and filtering parameters can be used with this method.
Response data keys
Name | Description |
---|---|
build | The Splunk Enterprise build number for this peer. |
bundle_versions | The IDs of the bundles (of this search head) that the peer has.
The IDs are sorted from latest to earliest. |
disabled | Indicates if the peer is disabled. |
guid | GUID of the peer. |
is_https | Inidcates if the management port is ussing SSL. |
licenseSignature | The license signature. |
peerName | The Splunk Enterprise server name of the peer. |
peerType | Specifies whether the peer is configured or discovered. |
replicationStatus | The status of bundle replication to this peer. Can be any of the following values:
|
status | The status of the peer.
Can be one of the following values:
|
version | The Splunk Enterprise version string this peer is running. |
[ Top ]
PREVIOUS Configuration endpoint examples |
NEXT Deployment endpoint examples |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14
Feedback submitted, thanks!