Splunk® Enterprise

REST API Reference Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Output endpoint examples

data/outputs/tcp/default GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/default
XML Response
.
.
.
 <title>tcpout-default</title>
 <id>https://localhost:8089/services/data/outputs/tcp/default</id>
 <updated>2011-07-10T22:38:23-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/default/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/default/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>tcpout</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/default/tcpout</id>
   <updated>2011-07-10T22:38:23-07:00</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="remove"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="autoLB">1</s:key>
       <s:key name="defaultGroup">spacecake_9998</s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl nodes elided ...
       <s:key name="forwardedindex.0.whitelist">.*</s:key>
       <s:key name="forwardedindex.1.blacklist">_.*</s:key>
       <s:key name="forwardedindex.2.whitelist">_audit</s:key>
       <s:key name="forwardedindex.filter.disable">0</s:key>
       <s:key name="indexAndForward">0</s:key>
       <s:key name="maxQueueSize">500KB</s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/default POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/default/tcpout -d 'defaultGroup=myIndexers'


XML Response
.
.
.
 <title>tcpout-default</title>
 <id>https://localhost:8089/services/data/outputs/tcp/default</id>
 <updated>2011-07-10T22:43:53-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/default/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/default/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/default/{name} DELETE

XML
XML Request
curl -k -u admin:changeme --request DELETE https://localhost:8089/services/data/outputs/tcp/default/tcpout


XML Response
.
.
.
<title>tcpout-default</title>
 <id>https://localhost:8085/services/data/outputs/tcp/default</id>
 <updated>2011-07-19T20:09:02-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/default/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/default/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/default/{name} GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/default/tcpout


XML Response
.
.
.
<title>tcpout-default</title>
 <id>https://localhost:8089/services/data/outputs/tcp/default</id>
 <updated>2011-07-10T22:38:23-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/default/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/default/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>tcpout</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/default/tcpout</id>
   <updated>2011-07-10T22:38:23-07:00</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout" rel="remove"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/default/tcpout/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="autoLB">1</s:key>
       <s:key name="defaultGroup">spacecake_9998</s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl nodes elided ...
       <s:key name="forwardedindex.0.whitelist">.*</s:key>
       <s:key name="forwardedindex.1.blacklist">_.*</s:key>
       <s:key name="forwardedindex.2.whitelist">_audit</s:key>
       <s:key name="forwardedindex.filter.disable">0</s:key>
       <s:key name="indexAndForward">0</s:key>
       <s:key name="maxQueueSize">500KB</s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/default/{name} POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/default/tcpout -d heartbeatFrequency=60


XML Response
.
.
.
 <title>tcpout-default</title>
 <id>https://localhost:8089/services/data/outputs/tcp/default</id>
 <updated>2011-07-10T22:43:53-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/default/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/default/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/group GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/group


XML Response
.
.
.
 <title>tcpout-group</title>
 <id>https://localhost:8089/services/data/outputs/tcp/group</id>
 <updated>2011-07-10T22:21:07-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/group/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/group/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>spacecake_9998</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/group/spacecake_9998</id>
   <updated>2011-07-10T22:21:07-07:00</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/spacecake_9998" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/spacecake_9998" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/spacecake_9998/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/spacecake_9998" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/spacecake_9998" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
       ... eai:acl nodes elided ...
       <s:key name="method">autobalance</s:key>
       <s:key name="servers">
         <s:list>
           <s:item>spacecake:9998</s:item>
         </s:list>
       </s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/group POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/group -d name=lan_receivers -d method=autobalance -d servers=10.3.3.3:9997,10.4.4.4:9997


XML Response
.
.
.
 <title>tcpout-group</title>
 <id>https://localhost:8089/services/data/outputs/tcp/group</id>
 <updated>2011-07-10T22:21:23-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/group/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/group/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/group/{name} DELETE

XML
XML Request
curl -k -u admin:changeme --request DELETE https://localhost:8089/services/data/outputs/tcp/group/lan_receivers


XML Response
.
.
.
 <title>tcpout-group</title>
 <id>https://localhost:8089/services/data/outputs/tcp/group</id>
 <updated>2011-07-10T22:32:47-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/group/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/group/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/group/{name} GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/group/lan_receivers


XML Response
.
.
.
<title>tcpout-group</title>
 <id>https://localhost:8089/services/data/outputs/tcp/group</id>
 <updated>2011-07-10T22:23:10-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/group/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/group/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>lan_receivers</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/group/lan_receivers</id>
   <updated>2011-07-10T22:23:10-07:00</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/lan_receivers" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/lan_receivers" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/lan_receivers/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/lan_receivers" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/group/lan_receivers" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="autoLB">1</s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl nodes elided ...
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list>
               <s:item>autoLB</s:item>
               <s:item>blockOnQueueFull</s:item>
               <s:item>compressed</s:item>
               <s:item>disabled</s:item>
               <s:item>dropEventsOnQueueFull</s:item>
               <s:item>heartbeatFrequency</s:item>
               <s:item>maxPersistentQueueSizeInMegs</s:item>
               <s:item>maxQueueSize</s:item>
               <s:item>method</s:item>
               <s:item>persistentQueuePath</s:item>
               <s:item>sendCookedData</s:item>
               <s:item>usePersistentQueue</s:item>
             </s:list>
           </s:key>
           <s:key name="requiredFields">
             <s:list>
               <s:item>servers</s:item>
             </s:list>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="method">autobalance</s:key>
       <s:key name="servers">
         <s:list>
           <s:item>10.3.3.3:9997</s:item>
           <s:item>10.4.4.4:9997</s:item>
         </s:list>
       </s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/group/{name} POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/group/lan_receivers -d maxQueueSize=1024KB -d servers=10.3.3.3:9997,10.4.4.4:9997


XML Response
.
.
.
 <title>tcpout-group</title>
 <id>https://localhost:8089/services/data/outputs/tcp/group</id>
 <updated>2011-07-10T22:26:02-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/group/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/group/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/server GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/server


XML Response
.
.
.
<title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:34:59-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>spacecake:9998</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998</id>
   <updated>2011-07-10T21:34:59-07:00</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="remove"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998/allconnections" rel="allconnections"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="destHost">spacecake.splunk.com</s:key>
       <s:key name="destIp">10.1.1.73</s:key>
       <s:key name="destPort">9998</s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl nodes elided ...
       <s:key name="method">autobalance</s:key>
       <s:key name="sourcePort">8085</s:key>
       <s:key name="status">connect_fail</s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/server POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/server -d name=tiny:9997


XML Response
.
.
.
  <title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:35:13-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/server/{name} DELETE

XML
XML Request
curl -k -u admin:changeme --request DELETE https://localhost:8089/services/data/outputs/tcp/server/tiny:9997


XML Response
.
.
.
 <title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:35:41-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/server/{name} GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/server/tiny:9997


XML Response
.
.
.
<title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:35:24-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>tiny:9997</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997</id>
   <updated>2011-07-10T21:35:24-07:00</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997" rel="remove"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997/allconnections" rel="allconnections"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/tiny%3A9997/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
       ... eai:acl nodes elided ...
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list>
               <s:item>backoffAtStartup</s:item>
               <s:item>disabled</s:item>
               <s:item>initialBackoff</s:item>
               <s:item>maxBackoff</s:item>
               <s:item>maxNumberOfRetriesAtHighestBackoff</s:item>
               <s:item>method</s:item>
               <s:item>sslAltNameToCheck</s:item>
               <s:item>sslCertPath</s:item>
               <s:item>sslCipher</s:item>
               <s:item>sslCommonNameToCheck</s:item>
               <s:item>sslPassword</s:item>
               <s:item>sslRootCAPath</s:item>
               <s:item>sslVerifyServerCert</s:item>
             </s:list>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="method">autobalance</s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/server/{name} POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/server/tiny:9997 -d initialBackoff=10


XML Response
.
.
.
 <title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:35:33-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>

data/outputs/tcp/server/{name}/allconnections GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/server/localhost%3A9997/allconnections


XML Response
.
.
.
<title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-15T15:15:12-0700</updated>
 <generator version="101277"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>localhost:9997</title>
   <id>https://localhost:8089/services/data/outputs/tcp/server/localhost%3A9997</id>
   <updated>2011-07-15T15:15:12-0700</updated>
   <link href="/services/data/outputs/tcp/server/localhost%3A9997" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/data/outputs/tcp/server/localhost%3A9997" rel="list"/>
   <link href="/services/data/outputs/tcp/server/localhost%3A9997/_reload" rel="_reload"/>
   <link href="/services/data/outputs/tcp/server/localhost%3A9997" rel="edit"/>
   <link href="/services/data/outputs/tcp/server/localhost%3A9997" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="destHost">localhost</s:key>
       <s:key name="destIp">127.0.0.1</s:key>
       <s:key name="destPort">9997</s:key>
       ... eai:acl nodes elided ...
       <s:key name="sourcePort">8089</s:key>
       <s:key name="status">connect_done</s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/syslog GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/syslog


XML Response
.
.
.
<title>syslog</title>
 <id>https://localhost:8089/services/data/outputs/tcp/syslog</id>
 <updated>2011-07-21T22:16:11-0700</updated>
 <generator version="101277"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/syslog/_new" rel="create"/>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>myServers</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers</id>
   <updated>2011-07-21T22:16:11-0700</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">1</s:key>
       ... eai:acl nodes elided ...
       <s:key name="server">syslogservers.splunk.com:514</s:key>
       <s:key name="type">tcp</s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/syslog POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/syslog -d myServers -d server=my.server.com:514


XML Response
.
.
.
<title>syslog</title>
 <id>https://localhost:22090/services/data/outputs/tcp/syslog</id>
 <updated>2011-07-21T23:00:26-07:00</updated>
 <generator version="104359"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/syslog/_new" rel="create"/>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>

data/outputs/tcp/syslog/{name} DELETE

XML
XML Request
curl -k -u admin:changeme --request DELETE https://localhost:8089/services/data/outputs/tcp/syslog/myServers


XML Response
.
.
.
 <title>syslog</title>
 <id>https://localhost:8089/services/data/outputs/tcp/syslog</id>
 <updated>2011-07-21T22:20:52-0700</updated>
 <generator version="101277"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/syslog/_new" rel="create"/>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>

data/outputs/tcp/syslog/{name} GET

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/syslog/myServers


XML Response
.
.
.
<title>syslog</title>
 <id>https://localhost:8089/services/data/outputs/tcp/syslog</id>
 <updated>2011-07-21T22:30:33-0700</updated>
 <generator version="101277"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/syslog/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>myServers</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers</id>
   <updated>2011-07-21T22:30:33-0700</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/syslog/myServers" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">1</s:key>
       ... eai:acl nodes elided ...
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list/>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="server">syslogservers.splunk.com:514</s:key>
       <s:key name="type">tcp</s:key>
     </s:dict>
   </content>
 </entry>

data/outputs/tcp/syslog/{name} POST

XML
XML Request
curl -k -u admin:changeme https://localhost:8089/services/data/outputs/tcp/syslog/myServers -d type=udp
XML Response
.
.
.
 <title>syslog</title>
 <id>https://localhost:8089/services/data/outputs/tcp/syslog</id>
 <updated>2011-07-21T22:53:23-07:00</updated>
 <generator version="104359"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/syslog/_new" rel="create"/>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
Last modified on 21 April, 2017
PREVIOUS
Output endpoint descriptions 		  NEXT
Search endpoint descriptions

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters