Splunk® Enterprise

REST API Reference Manual

Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

License endpoint descriptions

Manage licensing configurations.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Authentication and Authorization

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

App and user context

Typically, knowledge objects, such as saved searches or event types, have an app/user context that is the namespace. For more information about specifying a namespace, see Namespace in the REST API User Manual.

Splunk Cloud Platform limitations

As a Splunk Cloud Platform user, you are restricted to interacting with the search tier only with the REST API. License endpoints are generally not accessible in Splunk Cloud Platform.

See Access requirements and limitations for the Splunk Cloud Platform REST API in the the REST API Tutorials manual for more information.

licenser/groups

https://<host>:<mPort>/services/licenser/groups

Provides access to the configuration of licenser groups.

A licenser group contains one or more licenser stacks that can operate concurrently. Only one licenser group is active at any given time.

GET

Lists all licenser groups.


Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
is_active Indicates if the license group is active.
stack_ids The license stacks in the license group.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/groups

XML Response

...
 <title>groups</title>
 <id>https://localhost:8089/services/licenser/groups</id>
 <updated>2011-07-11T09:45:35-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>Enterprise</title>
   <id>https://localhost:8089/services/licenser/groups/Enterprise</id>
   <updated>2011-07-11T09:45:35-07:00</updated>
   <link href="/services/licenser/groups/Enterprise" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/groups/Enterprise" rel="list"/>
   <link href="/services/licenser/groups/Enterprise" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="is_active">1</s:key>
       <s:key name="stack_ids">
         <s:list>
           <s:item>enterprise</s:item>
         </s:list>
       </s:key>
     </s:dict>
   </content>
 </entry>


licenser/groups/{name}

https://<host>:<mPort>/services/licenser/groups/{name}


Manage the {name} licenser group.


GET

List a specific licenser group.

Usage details
A licenser group contains one or more licenser stacks that can operate concurrently. Only one licenser group is active at any given time.


Request parameters

None


Returned values

Name Description
is_active Indicates if the license group is active.
stack_ids The license stacks in the license group.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/groups/Forwarder

XML Response

...
 <title>groups</title>
 <id>https://localhost:8089/services/licenser/groups</id>
 <updated>2011-07-11T09:47:18-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>Forwarder</title>
   <id>https://localhost:8089/services/licenser/groups/Forwarder</id>
   <updated>2011-07-11T09:47:18-07:00</updated>
   <link href="/services/licenser/groups/Forwarder" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/groups/Forwarder" rel="list"/>
   <link href="/services/licenser/groups/Forwarder" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       ... eai:acl node elided ...
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list/>
           </s:key>
           <s:key name="requiredFields">
             <s:list>
               <s:item>is_active</s:item>
             </s:list>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="is_active">0</s:key>
       <s:key name="stack_ids">
         <s:list>
           <s:item>forwarder</s:item>
         </s:list>
       </s:key>
     </s:dict>
   </content>
 </entry>


POST

Activate a specific licenser group and deactivate the previously active one.


Usage details
There can only be a single active licenser group for a given Splunk instance. Use this to switch between, for example, free to enterprise, or download-trial to free.

Request parameters

Name Type Default Description
is_active Boolean Required. Active specific licenser group


Returned values

None


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/groups/Enterprise -d is_active=1

XML Response

 <title>groups</title>
 <id>https://localhost:8089/services/licenser/groups</id>
 <updated>2011-07-11T09:55:02-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>



licenser/licenses

https://<host>:<mPort>/services/licenser/licenses


Provides access to the licenses for this Splunk Enterprise instance.

A license enables various features for a Splunk instance, including but not limited to indexing quota, auth, search, forwarding.


GET

List all licenses added.

Usage details
Only a subset of these licenses may be active however, this is simply listing all licenses in every stack/group, regardless of which group is active.

Request parameters

Pagination and filtering parameters can be used with this method.


Returned values

Name Description
creation_time The creation time of this license, in Coordinated Universal Time (UTC).
expiration_time The time this license expires, in Coordinated Universal Time (UTC).
features The list of features and components enabled by this license.
group_id The ID of the group to which this license belongs.
label Plain text description of this license.
license_hash Unique identifier for the license.

The REST API uses this identifier to access this license.

max_violations The maximum number of violations allowed during the specified window period (window_period.

Searching is disabled when max_violations is exceeded.

quota Daily indexing quota, in bytes, for this license.
sourcetypes The list of allowed sourcetypes for this list. You cannot use this license to index sourcetypes that are not present in this list.

An empty list indicates all sourcetypes are allowed.

stack_id The ID of the license stack to which this license belongs.
status The status of a license can be either VALID or EXPIRED.
type Provides any additional information about the type of this license.
window_period The rolling period, in days, in which violations are aggregated.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/licenses

XML Response

...
<title>licenses</title>
 <id>https://localhost:8089/services/licenser/licenses</id>
 <updated>2011-07-11T09:30:33-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/licenses/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>E08B ... elided ...FA75BF</title>
   <id>https://localhost:8089/services/licenser/licenses/E08B ... elided ...FA75BF</id>
   <updated>2011-07-11T09:30:33-07:00</updated>
   <link href="/services/licenser/licenses/E08B ... elided ...FA75BF" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/licenses/E08B ... elided ...FA75BF" rel="list"/>
   <link href="/services/licenser/licenses/E08B ... elided ...FA75BF" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="creation_time">1309852804</s:key>
       ... eai:acl node elided ...
       <s:key name="expiration_time">1315641604</s:key>
       <s:key name="features">
         <s:list>
           <s:item>Auth</s:item>
           <s:item>FwdData</s:item>
           <s:item>RcvData</s:item>
           <s:item>LocalSearch</s:item>
           <s:item>DistSearch</s:item>
           <s:item>RcvSearch</s:item>
           <s:item>ScheduledSearch</s:item>
           <s:item>Alerting</s:item>
           <s:item>DeployClient</s:item>
           <s:item>DeployServer</s:item>
           <s:item>SplunkWeb</s:item>
           <s:item>SigningProcessor</s:item>
           <s:item>SyslogOutputProcessor</s:item>
           <s:item>AllowDuplicateKeys</s:item>
         </s:list>
       </s:key>
       <s:key name="group_id">Trial</s:key>
       <s:key name="label">Splunk Enterprise Download Trial</s:key>
       <s:key name="license_hash">E08B ... elided ...FA75BF</s:key>
       <s:key name="max_violations">5</s:key>
       <s:key name="quota">524288000</s:key>
       <s:key name="sourcetypes">
         <s:list/>
       </s:key>
       <s:key name="stack_id">download-trial</s:key>
       <s:key name="status">VALID</s:key>
       <s:key name="type">download-trial</s:key>
       <s:key name="window_period">30</s:key>
     </s:dict>
   </content>
 </entry>



POST

Add a license entitlement to the current instance.


Request parameters

Name Type Default Description
name string Required. Path to license file on server. If the payload parameter is specified, the name parameter is ignored.
payload string String representation of license, encoded in xml


Returned values

Name Description
creation_time The creation time of this license, in Coordinated Universal Time (UTC).
expiration_time The time this license expires, in Coordinated Universal Time (UTC).
features The list of features and components enabled by this license.
group_id The ID of the group to which this license belongs.
label Plain text description of this license.
license_hash Unique identifier for the license.

The REST API uses this identifier to access this license.

max_violations The maximum number of violations allowed during the specified window period (window_period.

Searching is disabled when max_violations is exceeded.

payload String representation of license, encoded in xml.
quota Daily indexing quota, in bytes, for this license.
sourcetypes The list of allowed sourcetypes for this list. You cannot use this license to index sourcetypes that are not present in this list.

An empty list indicates all sourcetypes are allowed.

stack_id The ID of the license stack to which this license belongs.
status The status of a license can be either VALID or EXPIRED.
type Provides any additional information about the type of this license.
window_period The rolling period, in days, in which violations are aggregated.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/licenses -d name=/Users/myusername/downloads/Splunk_enterprise.lic

XML Response

...
 <title>licenses</title>
 <id>https://localhost:8089/services/licenser/licenses</id>
 <updated>2011-07-11T09:41:32-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/licenses/_new" rel="create"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>CF6C50 ... elided ...72CE6C</title>
   <id>https://localhost:8089/services/licenser/licenses/CF6C50 ... elided ...72CE6C</id>
   <updated>2011-07-11T09:41:32-07:00</updated>
   <link href="/services/licenser/licenses/CF6C50 ... elided ...72CE6C" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/licenses/CF6C50 ... elided ...72CE6C" rel="list"/>
   <link href="/services/licenser/licenses/CF6C50 ... elided ...72CE6C" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="creation_time">1306168427</s:key>
       ... eai:acl node elided ...
       <s:key name="expiration_time">2147483647</s:key>
       <s:key name="features">
         <s:list>
           <s:item>Auth</s:item>
           <s:item>FwdData</s:item>
           <s:item>RcvData</s:item>
           <s:item>LocalSearch</s:item>
           <s:item>DistSearch</s:item>
           <s:item>RcvSearch</s:item>
           <s:item>ScheduledSearch</s:item>
           <s:item>Alerting</s:item>
           <s:item>DeployClient</s:item>
           <s:item>DeployServer</s:item>
           <s:item>SplunkWeb</s:item>
           <s:item>SigningProcessor</s:item>
           <s:item>SyslogOutputProcessor</s:item>
           <s:item>CanBeRemoteMaster</s:item>
         </s:list>
       </s:key>
       <s:key name="group_id">Enterprise</s:key>
       <s:key name="label">Splunk Enterprise</s:key>
       <s:key name="license_hash">CF6C50 ... elided ...72CE6C</s:key>
       <s:key name="max_violations">5</s:key>
       <s:key name="quota">10737418240</s:key>
       <s:key name="sourcetypes">
         <s:list/>
       </s:key>
       <s:key name="stack_id">enterprise</s:key>
       <s:key name="status">VALID</s:key>
       <s:key name="type">enterprise</s:key>
       <s:key name="window_period">30</s:key>
     </s:dict>
   </content>
 </entry>


licenser/licenses/{name}

https://<host>:<mPort>/services/licenser/licenses/{name}

Access or delete the {name} license.


DELETE

Delete the license with a hash corresponding to {name}

Usage details
You cannot delete the last license out of an active group. First, deactivate the group (by switching to another group) and then perform the delete.


Request parameters
None


Returned values
None


Example request and response


XML Request

curl -k -u admin:pass --request DELETE https://localhost:8089/services/licenser/licenses/E4BF ... elided ...FC639D

XML Response

...
 <title>licenses</title>
 <id>https://localhost:8089/services/licenser/licenses</id>
 <updated>2011-07-07T09:45:12-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/licenses/_new" rel="create"/>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>



GET

List license details.

Usage details
The {name} portion of URL is the hash of the license payload.


Request parameters
None


Returned values

Name Description
creation_time The creation time of this license, in Coordinated Universal Time (UTC).
expiration_time The time this license expires, in Coordinated Universal Time (UTC).
features The list of features and components enabled by this license.
group_id The ID of the group to which this license belongs.
label Plain text description of this license.
license_hash Unique identifier for the license.

The REST API uses this identifier to access this license.

max_violations The maximum number of violations allowed during the specified window period (window_period.

Searching is disabled when max_violations is exceeded.

quota Daily indexing quota, in bytes, for this license.
sourcetypes The list of allowed sourcetypes for this list. You cannot use this license to index sourcetypes that are not present in this list.

An empty list indicates all sourcetypes are allowed.

stack_id The ID of the license stack to which this license belongs.
status The status of a license can be either VALID or EXPIRED.
type Provides any additional information about the type of this license.
window_period The rolling period, in days, in which violations are aggregated.


Example request and response


XML Request

curl -k -u admin:pass https://127.0.0.1:3339/services/licenser/licenses/E4BF ... elided ...FC639D

XML Response

...
<title>licenses</title>
 <id>https://localhost:8089/services/licenser/licenses</id>
 <updated>2011-07-05T15:57:08-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/licenses/_new" rel="create"/>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>E4BF ... elided ...FC639D</title>
   <id>https://localhost:8089/services/licenser/licenses/E4BF ... elided ...FC639D</id>
   <updated>2011-07-05T15:57:08-07:00</updated>
   <link href="/services/licenser/licenses/E4BF ... elided ...FC639D" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/licenses/E4BF ... elided ...FC639D" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="creation_time">1300901512</s:key>
       <s:key name="eai:acl"> ... elided ...</s:key>
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list/>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="expiration_time">1314811912</s:key>
       <s:key name="features">
         <s:list>
           <s:item>Auth</s:item>
           <s:item>FwdData</s:item>
           <s:item>RcvData</s:item>
           <s:item>LocalSearch</s:item>
           <s:item>DistSearch</s:item>
           <s:item>RcvSearch</s:item>
           <s:item>ScheduledSearch</s:item>
           <s:item>Alerting</s:item>
           <s:item>DeployClient</s:item>
           <s:item>DeployServer</s:item>
           <s:item>SplunkWeb</s:item>
           <s:item>SigningProcessor</s:item>
           <s:item>SyslogOutputProcessor</s:item>
           <s:item>AllowDuplicateKeys</s:item>
           <s:item>CanBeRemoteMaster</s:item>
         </s:list>
       </s:key>
       <s:key name="group_id">Enterprise</s:key>
       <s:key name="label">Splunk Internal License</s:key>
       <s:key name="license_hash">E4BF ... elided ...FC639D</s:key>
       <s:key name="max_violations">5</s:key>
       <s:key name="quota">10737418240</s:key>
       <s:key name="sourcetypes"><s:list/></s:key>
       <s:key name="stack_id">enterprise</s:key>
       <s:key name="status">VALID</s:key>
       <s:key name="type">enterprise</s:key>
       <s:key name="window_period">30</s:key>
     </s:dict>
   </content>
 </entry>


licenser/localslave

https://<host>:<mPort>/services/licenser/localslave

Get license state information for the Splunk instance.

GET

Get license state information for the Splunk instance.


Request parameters
None


Returned values

Name Description
add_ons List of add-ons resident on this instance, and add-on parameters.
connection_timeout Instance connection timeout (seconds).
features List of key-value pairs of the following features and their ENABLED/DISABLED status:
  • Acceleration
  • AdvancedSearchCommands
  • AdvancedXML
  • Alerting
  • AllowDuplicateKeys
  • Auth
  • CanBeRemoteMaster
  • CustomRoles
  • DeployClient
  • DeployServer
  • DistSearch
  • FwdData
  • GuestPass
  • KVStore
  • LDAPAuth
  • LocalSearch
  • MultisiteClustering
  • NontableLookups
  • RcvData
  • RcvSearch
  • ResetWarnings">DISABLED_DUE_TO_LICENSE</s:key>
  • RollingWindowAlerts
  • ScheduledAlerts
  • ScheduledReports
  • ScheduledSearch
  • SearchheadPooling
  • SigningProcessor
  • SplunkWeb
  • SyslogOutputProcessor
  • UnisiteClustering
last_master_contact_attempt_time Time of last attempt to contact master.
last_master_contact_success_time Time of last successful attempt to contact master.
last_trackerdb_service_time Time of last license servicing, tracking persistent store.
license_keys List of license keys this instance is using.
master_guid Master license GUID.
master_uri Master license URI.
receive_timeout Network layer receive timeout for communication to master (seconds).
send_timeout Network layer send timeout for communication to master (seconds).
slave_id This instance GUID.
slave_label This instance server name.
squash_threshold Threshold that enables source/host squashing of rows of usage data sent to master periodically.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/localslave

XML Response

...
 <title>localslave</title>
 <id>https://localhost:8089/services/licenser/localslave</id>
 <updated>2014-09-08T11:30:21-07:00</updated>
 <generator build="221120" version="6.2"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>license</title>
   <id>https://localhost:8089/services/licenser/localslave/license</id>
   <updated>2014-09-08T11:30:21-07:00</updated>
   <link href="/services/licenser/localslave/license" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/localslave/license" rel="list"/>
   <link href="/services/licenser/localslave/license" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="add_ons">
         <s:dict>
           <s:key name="hadoop">
             <s:dict>
               <s:key name="parameters">
                 <s:dict>
                   <s:key name="erp_type">report</s:key>
                   <s:key name="maxNodes">10</s:key>
                 </s:dict>
               </s:key>
               <s:key name="type">external_results_provider</s:key>
             </s:dict>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="connection_timeout">30</s:key>
       <s:key name="eai:acl"> ... elided ... </s:key>
       <s:key name="features">
         <s:dict>
           <s:key name="Acceleration">ENABLED</s:key>
           <s:key name="AdvancedSearchCommands">ENABLED</s:key>
           <s:key name="AdvancedXML">ENABLED</s:key>
           <s:key name="Alerting">ENABLED</s:key>
           <s:key name="AllowDuplicateKeys">ENABLED</s:key>
           <s:key name="Auth">ENABLED</s:key>
           <s:key name="CanBeRemoteMaster">ENABLED</s:key>
           <s:key name="CustomRoles">ENABLED</s:key>
           <s:key name="DeployClient">ENABLED</s:key>
           <s:key name="DeployServer">ENABLED</s:key>
           <s:key name="DistSearch">ENABLED</s:key>
           <s:key name="FwdData">ENABLED</s:key>
           <s:key name="GuestPass">ENABLED</s:key>
           <s:key name="KVStore">ENABLED</s:key>
           <s:key name="LDAPAuth">ENABLED</s:key>
           <s:key name="LocalSearch">ENABLED</s:key>
           <s:key name="MultisiteClustering">ENABLED</s:key>
           <s:key name="NontableLookups">ENABLED</s:key>
           <s:key name="RcvData">ENABLED</s:key>
           <s:key name="RcvSearch">ENABLED</s:key>
           <s:key name="ResetWarnings">DISABLED_DUE_TO_LICENSE</s:key>
           <s:key name="RollingWindowAlerts">ENABLED</s:key>
           <s:key name="ScheduledAlerts">ENABLED</s:key>
           <s:key name="ScheduledReports">ENABLED</s:key>
           <s:key name="ScheduledSearch">ENABLED</s:key>
           <s:key name="SearchheadPooling">ENABLED</s:key>
           <s:key name="SigningProcessor">ENABLED</s:key>
           <s:key name="SplunkWeb">ENABLED</s:key>
           <s:key name="SyslogOutputProcessor">ENABLED</s:key>
           <s:key name="UnisiteClustering">ENABLED</s:key>
         </s:dict>
       </s:key>
       <s:key name="last_master_contact_attempt_time">1410201013</s:key>
       <s:key name="last_master_contact_success_time">1410201013</s:key>
       <s:key name="last_trackerdb_service_time">0</s:key>
       <s:key name="license_keys">
         <s:list>
           <s:item>4467A79214BACAD9BB01F28193D6E15129DADC3B99D69D78884D4D68D2DDE750</s:item>
         </s:list>
       </s:key>
       <s:key name="master_guid">9CBD8473-4E7D-4FF2-A042-050C5C27C298</s:key>
       <s:key name="master_uri">self</s:key>
       <s:key name="receive_timeout">30</s:key>
       <s:key name="send_timeout">30</s:key>
       <s:key name="slave_id">9CBD8473-4E7D-4FF2-A042-050C5C27C298</s:key>
       <s:key name="slave_label">MY MACHINE</s:key>
       <s:key name="squash_threshold">2000</s:key>
     </s:dict>
   </content>
 </entry>


licenser/messages

https://<host>:<mPort>/services/licenser/messages

Access licenser messages.

Messages may range from helpful warnings about being close to violations, licenses expiring or more severe alerts regarding overages and exceeding license warning window.


GET

List all messages/alerts/persisted warnings for this node.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
category Indicates the category for the licenser message. The category can be any of the following:

license_window

pool_over_quota

stack_over_quota

orphan_slave

pool_warning_count

pool_violated_slave_count

create_time The time the message was created in the system, expressed in Coordinated Universal time (UTC).
description The actual licenser message that is displayed.
pool_id The ID of the licesne pool to which the message applies.

If a pool ID is not present, then the message in not applicable to a specific license pool.

severity Indicates the severity of the message. The severity can be any of the following:

INFO

WARN

ERROR

slave_id The ID of the license slave to which the message applies.
stack_id The ID of the license stack to which the message applies.

If a stack ID is not present, thae the message is not applicable to a specific license stack.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/messages

XML Response

...
 <title>licensermessages</title>
 <id>https://localhost:8089/services/licenser/messages</id>
 <updated>2011-08-02T03:50:46-07:00</updated>
 <generator version="105103"/>
 <author>
   <name>Splunk</name>
 </author>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>70a19a5cfe6d7c2a678089638dee7bea</title>
   <id>https://localhost:8089/services/licenser/messages/70a19a5cfe6d7c2a678089638dee7bea</id>
   <updated>2011-08-02T03:50:46-07:00</updated>
   <link href="/services/licenser/messages/70a19a5cfe6d7c2a678089638dee7bea" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/messages/70a19a5cfe6d7c2a678089638dee7bea" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="category">pool_warning_count</s:key>
       <s:key name="create_time">1312282230</s:key>
       <s:key name="description">This pool contains slave(s) with 3 warnings</s:key>
       ... eai:acl node elided ...
       <s:key name="pool_id"/>
       <s:key name="severity">WARN</s:key>
       <s:key name="slave_id"/>
       <s:key name="stack_id"/>
     </s:dict>
   </content>
 </entry>


licenser/messages/{name}

https://<host>:<mPort>/services/licenser/messages/{name}

Get the message with message ID {name}.


GET

List specific message whose msgId corresponds to {name} component.


Request parameters
None


Returned values

Name Description
category Indicates the category for the licenser message. The category can be any of the following:

license_window

pool_over_quota

stack_over_quota

orphan_slave

pool_warning_count

pool_violated_slave_count

create_time The time the message was created in the system, expressed in Coordinated Universal time (UTC).
description The actual licenser message that is displayed.
pool_id The ID of the licesne pool to which the message applies.

If a pool ID is not present, then the message in not applicable to a specific license pool.

severity Indicates the severity of the message. The severity can be any of the following:

INFO

WARN

ERROR

slave_id The ID of the license slave to which the message applies.
stack_id The ID of the license stack to which the message applies.

If a stack ID is not present, thae the message is not applicable to a specific license stack.


Example request and response


XML Request

curl -k -u admin:pass https://127.0.0.1:3339/services/licenser/messages/2702b33a1bd369ae9209a9ecf4cb39db

XML Response

...
  <title>licensermessages</title>
   <id>https://127.0.0.1:3339/services/licenser/messages</id>
   <updated>2011-05-16T21:45:17-07:00</updated>
   <generator version="99678"/>
   <author>
       <name>Splunk</name>
   </author>
   <opensearch:totalResults>1</opensearch:totalResults>
   <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
   <opensearch:startIndex>0</opensearch:startIndex>
   <s:messages/>
   <entry>
       <title>2702b33a1bd369ae9209a9ecf4cb39db</title>
       <id>https://127.0.0.1:3339/services/licenser/messages/2702b33a1bd369ae9209a9ecf4cb39db</id>
       <updated>2011-05-16T21:45:17-07:00</updated>
       <link href="/services/licenser/messages/2702b33a1bd369ae9209a9ecf4cb39db" rel="alternate"/>
       <author>
           <name>system</name>
       </author>
       <link href="/services/licenser/messages/2702b33a1bd369ae9209a9ecf4cb39db" rel="list"/>
       <content type="text/xml">
           <s:dict>
               <s:key name="category">license_window</s:key>
               <s:key name="create_time">1305607136</s:key>
               <s:key name="description">test warnings</s:key>
               <s:key name="eai:acl">... elided ...</s:key>
               <s:key name="eai:attributes">
                   <s:dict>
                       <s:key name="optionalFields">
                           <s:list/>
                       </s:key>
                       <s:key name="requiredFields">
                           <s:list/>
                       </s:key>
                       <s:key name="wildcardFields">
                           <s:list/>
                       </s:key>
                   </s:dict>
               </s:key>
               <s:key name="pool_id"/>
               <s:key name="severity">WARN</s:key>
               <s:key name="slave_id"/>
               <s:key name="stack_id"/>
           </s:dict>
       </content>
   </entry>


licenser/pools

https://<host>:<mPort>/services/licenser/pools


Access the licenser pools configuration.

A pool logically partitions the daily volume entitlements of a stack. You can use a license pool to divide license privileges amongst multiple slaves.


GET

Enumerate all pools.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
description Description of the license pool.
quota The byte quota of this license pool.

MAX: maximum amount allowed by the license. You can only have one pool with MAX size in a stack.

Number: the number of bytes allowed by this license.

slaves slaveids that are members of this pool.

Returned as a list in Atom format. See example below.

slaves_usage_bytes Usage, in bytes, of slaves to this license.
stack_id Stack ID of the stack corresponding to this pool.
used_bytes Usage, in bytes, for this license pool.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/pools

XML Response

 <title>pools</title>
 <id>https://localhost:8089/services/licenser/pools</id>
 <updated>2011-07-08T10:55:18-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/pools/_new" rel="create"/>
 <link href="/services/licenser/pools/_reload" rel="_reload"/>
 <opensearch:totalResults>4</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 ... elided ...
 <entry>
   <title>auto_generated_pool_enterprise</title>
   <id>https://localhost:8089/servicesNS/nobody/system/licenser/pools/auto_generated_pool_enterprise</id>
   <updated>2011-07-08T10:55:18-07:00</updated>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_enterprise" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_enterprise" rel="list"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_enterprise/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_enterprise" rel="edit"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_enterprise" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="description">auto_generated_pool_enterprise</s:key>
       <s:key name="eai:acl"> ... elided ...</s:key>
       <s:key name="quota">MAX</s:key>
       <s:key name="slaves"><s:list><s:item>*</s:item></s:list></s:key>
       <s:key name="slaves_usage_bytes">
         <s:dict><s:key name="1F3A34AE-75DA-4680-B184-5BF309843919">26445659</s:key></s:dict>
       </s:key>
       <s:key name="stack_id">enterprise</s:key>
       <s:key name="used_bytes">26445659</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>auto_generated_pool_forwarder</title>
   <id>https://localhost:8089/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder</id>
   <updated>2011-07-08T10:55:18-07:00</updated>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="list"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="edit"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="description">auto_generated_pool_forwarder</s:key>
      <s:key name="eai:acl"> ... elided ...</s:key>
       <s:key name="quota">MAX</s:key>
       <s:key name="slaves"><s:list><s:item>*</s:item></s:list></s:key>
       <s:key name="slaves_usage_bytes"></s:key>
       <s:key name="stack_id">forwarder</s:key>
       <s:key name="used_bytes">0</s:key>
     </s:dict>
   </content>
 </entry>
 ... elided ...



POST

Create a license pool.


Request parameters

description String Description of this pool
Name Type Default Description
name String Required. The name of the license pool you are creating.
quota String Required. Defines the byte quota of this pool.

Valid values:

MAX: maximum amount allowed by the license. You can only have one pool with MAX size in a stack.

Number[MB|GB]: Specify a specific size. For example, 552428800, or simply specify 50MB.

slaves String Comma-separated list of slaveids that are members of this pool, or '*' to accept all slaves.

You can also specify a comma-separated list of guids to specify slaves that can connect to this pool.

stack_id Enum Required. Valid values: (download-trial | Enterprise | Forwarder | Free | Lite | Lite_Free)

Stack ID of the stack corresponding to this pool


Returned values

None

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/pools -d name=myLicensePool -d quota=MAX -d slaves=* -d stack_id=enterprise

XML Response

...
 <title>pools</title>
 <id>https://localhost:8089/services/licenser/pools</id>
 <updated>2011-07-08T11:31:47-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/pools/_new" rel="create"/>
 <link href="/services/licenser/pools/_reload" rel="_reload"/>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>


licenser/pools/{name}

https://<host>:<mPort>/services/licenser/pools/{name}


Manage the {name} license pool.


DELETE

Delete the specified pool.

Usage details
Deleting pools is not supported for every pool. Certain stacks have fixed pools which cannot be deleted.


Request parameters
None


Returned values

None


Example request and response


XML Request

curl -k -u admin:pass --request DELETE https://localhost:8089/services/licenser/pools/auto_generated_pool_enterprise

XML Response

...
 <title>pools</title>
 <id>https://localhost:8089/services/licenser/pools</id>
 <updated>2011-07-08T11:29:26-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/pools/_new" rel="create"/>
 <link href="/services/licenser/pools/_reload" rel="_reload"/>
 <opensearch:totalResults>0</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>



GET

Lists details of the pool specified by {name}.


Request parameters

None


Returned values

Name Description
description Description of the license pool.
quota The byte quota of this license pool.

MAX: maximum amount allowed by the license. You can only have one pool with MAX size in a stack.

Number: the number of bytes allowed by this license.

slaves slaveids that are members of this pool.

Returned as a list in Atom format. See example below.

slaves_usage_bytes Usage, in bytes, of slaves to this license.
stack_id Stack ID of the stack corresponding to this pool.
used_bytes Usage, in bytes, for this license pool.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/pools/auto_generated_pool_forwarder

XML Response

...
<title>pools</title>
 <id>https://localhost:8089/services/licenser/pools</id>
 <updated>2011-07-08T11:03:37-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/licenser/pools/_new" rel="create"/>
 <link href="/services/licenser/pools/_reload" rel="_reload"/>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>auto_generated_pool_forwarder</title>
   <id>https://localhost:8089/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder</id>
   <updated>2011-07-08T11:03:37-07:00</updated>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="list"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="edit"/>
   <link href="/servicesNS/nobody/system/licenser/pools/auto_generated_pool_forwarder" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="description">auto_generated_pool_forwarder</s:key>
       <s:key name="eai:acl"> ... elided ...</s:key>
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list>
               <s:item>append_slaves</s:item>
               <s:item>description</s:item>
               <s:item>quota</s:item>
               <s:item>slaves</s:item>
             </s:list>
           </s:key>
           <s:key name="requiredFields">
             <s:list/></s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="quota">MAX</s:key>
       <s:key name="slaves"><s:list><s:item>*</s:item></s:list></s:key>
       <s:key name="slaves_usage_bytes"></s:key>
       <s:key name="stack_id">forwarder</s:key>
       <s:key name="used_bytes">0</s:key>
     </s:dict>
   </content>
 </entry>



POST

Edit properties of the pool specified by {name}.


Request parameters

Name Type Default Description
append_slaves Boolean Flag which controls whether newly specified slaves is appended to existing slaves list or overwritten
description String Description of this pool
quota String Defines the byte quota of this pool.

Valid values:

MAX: maximum amount allowed by the license. You can only have one pool with MAX size in a stack.

Number[MB|GB]: Specify a specific size. For example, 552428800, or simply specify 50MB.

slaves String Comma-separated list of slaveids that are members of this pool, or '*' to accept all slaves.

You can also specify a comma-separated list of guids to specify slaves that can connect to this pool.


Returned values
None


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/pools/myLicensePool -d quota=50MB

XML Response

  ... elided ...
 <entry>
   <title>myLicensePool</title>
   <id>https://localhost:8085/servicesNS/nobody/system/licenser/pools/myLicensePool</id>
   <updated>2011-07-24T08:46:49-07:00</updated>
   <link href="/servicesNS/nobody/system/licenser/pools/myLicensePool" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/licenser/pools/myLicensePool" rel="list"/>
   <link href="/servicesNS/nobody/system/licenser/pools/myLicensePool/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/licenser/pools/myLicensePool" rel="edit"/>
   <link href="/servicesNS/nobody/system/licenser/pools/myLicensePool" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="description"></s:key>
       ... eai:acl node elided ...
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list>
               <s:item>append_slaves</s:item>
               <s:item>description</s:item>
               <s:item>quota</s:item>
               <s:item>slaves</s:item>
             </s:list>
           </s:key>
           <s:key name="requiredFields">
             <s:list/></s:key>
           <s:key name="wildcardFields">
             <s:list/></s:key>
         </s:dict>
       </s:key>
       <s:key name="quota">552428800</s:key>
       <s:key name="slaves"><s:list><s:item>*</s:item></s:list></s:key>
       <s:key name="slaves_usage_bytes">
         <s:dict>
           <s:key name="1F3A34AE-75DA-4680-B184-5BF309843919">39846322</s:key>
         </s:dict>
       </s:key>
       <s:key name="stack_id">enterprise</s:key>
       <s:key name="used_bytes">39846322</s:key>
     </s:dict>
   </content>
 </entry>


licenser/slaves

https://<host>:<mPort>/services/licenser/slaves


Access license slave instances.


GET

List all slaves registered to this license master.


Request parameters


Returned values

Name Description
label Plain text name for the license slave.
pool_ids License pools for which this license slave is a member.
stack_ids License stacks for which this license slave is a member.
warning_count Number of license warnings issued for this license slave.

Usage details
Any license slave master connection attempt is reported regardless of whether it is allocated to a master licenser pool.


Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/slaves

XML Response

<title>slaves</title>
 <id>https://localhost:8089/services/licenser/slaves</id>
 <updated>2011-05-17T09:37:54-07:00</updated>
 <generator version="99849"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>74A43C7E-C33C-41F6-B027-E603D2C3FE68</title>
   <id>https://localhost:8089/servicesNS/nobody/system/licenser/slaves/74A43C7E-C33C-41F6-B027-E603D2C3FE68</id>
   <updated>2011-05-17T09:37:54-07:00</updated>
   <link href="/servicesNS/nobody/system/licenser/slaves/74A43C7E-C33C-41F6-B027-E603D2C3FE68" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/licenser/slaves/74A43C7E-C33C-41F6-B027-E603D2C3FE68" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         <s:dict>
           <s:key name="app">system</s:key>
           <s:key name="can_write">1</s:key>
             <s:key name="modifiable">0</s:key>
           <s:key name="owner">nobody</s:key>
           <s:key name="perms">
             <s:dict>
               <s:key name="read">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
               <s:key name="write">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="sharing">system</s:key>
         </s:dict>
       </s:key>
       <s:key name="label">thething-vishalp</s:key>
       <s:key name="pool_ids">
         <s:list>
           <s:item>auto_generated_pool_enterprise</s:item>
           <s:item>auto_generated_pool_forwarder</s:item>
           <s:item>auto_generated_pool_free</s:item>
         </s:list>
       </s:key>
       <s:key name="stack_ids">
         <s:list>
           <s:item>enterprise</s:item>
           <s:item>forwarder</s:item>
           <s:item>free</s:item>
         </s:list>
       </s:key>
       <s:key name="warning_count">0</s:key>
     </s:dict>
   </content>
 </entry>


licenser/slaves/{name}

https://<host>:<mPort>/services/licenser/slaves/{name}


Get {name} licenser slave license information.


GET

List attributes of the slave instance specified by {name}.


Request parameters

None


Returned values

Name Description
label Plain text name for the license slave.
pool_ids License pools for which this license slave is a member.
stack_ids License stacks for which this license slave is a member.
warning_count Number of license warnings issued for this license slave.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/slaves/74A43C7E-C33C-41F6-B027-E603D2C3FE68

XML Response

...
<title>slaves</title>
 <id>https://127.0.0.1:8282/services/licenser/slaves</id>
 <updated>2011-05-17T09:44:10-07:00</updated>
 <generator version="99849"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>74A43C7E-C33C-41F6-B027-E603D2C3FE68</title>
   <id>https://127.0.0.1:8282/servicesNS/nobody/system/licenser/slaves/74A43C7E-C33C-41F6-B027-E603D2C3FE68</id>
   <updated>2011-05-17T09:44:10-07:00</updated>
   <link href="/servicesNS/nobody/system/licenser/slaves/74A43C7E-C33C-41F6-B027-E603D2C3FE68" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/licenser/slaves/74A43C7E-C33C-41F6-B027-E603D2C3FE68" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         <s:dict>
           <s:key name="app">system</s:key>
           <s:key name="can_write">1</s:key>
           <s:key name="modifiable">0</s:key>
           <s:key name="owner">nobody</s:key>
           <s:key name="perms">
             <s:dict>
               <s:key name="read">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
               <s:key name="write">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="sharing">system</s:key>
         </s:dict>
       </s:key>
       <s:key name="eai:attributes">
         <s:dict>
           <s:key name="optionalFields">
             <s:list/>
           </s:key>
           <s:key name="requiredFields">
             <s:list/>
           </s:key>
           <s:key name="wildcardFields">
             <s:list/>
           </s:key>
         </s:dict>
       </s:key>
       <s:key name="label">thething-vishalp</s:key>
       <s:key name="pool_ids">
         <s:list>
           <s:item>auto_generated_pool_enterprise</s:item>
           <s:item>auto_generated_pool_forwarder</s:item>
           <s:item>auto_generated_pool_free</s:item>
         </s:list>
       </s:key>
       <s:key name="stack_ids">
         <s:list>
           <s:item>enterprise</s:item>
           <s:item>forwarder</s:item>
           <s:item>free</s:item>
         </s:list>
       </s:key>
       <s:key name="warning_count">0</s:key>
     </s:dict>
   </content>
 </entry>


licenser/stacks

https://<host>:<mPort>/services/licenser/stacks


Provides access to the license stack configuration.

A license stack is comprised of one or more licenses of the same "type". The daily indexing quota of a license stack is additive, so a stack represents the aggregate entitlement for a collection of licenses.

GET

Enumerate all license stacks.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
label The name of this license stack.
quota The byte quota of this license stack. This value is the sum of the byte quota for all the licenses in the license stack.
type Any additional information about the type of this license stack.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/stacks

XML Response

<title>stacks</title>
 <id>https://localhost:8089/services/licenser/stacks</id>
 <updated>2011-07-08T10:37:33-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>4</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>download-trial</title>
   <id>https://localhost:8089/services/licenser/stacks/download-trial</id>
   <updated>2011-07-08T10:37:33-07:00</updated>
   <link href="/services/licenser/stacks/download-trial" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/stacks/download-trial" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">... elided ...</s:key>
       <s:key name="label">Splunk Enterprise Download Trial</s:key>
       <s:key name="quota">524288000</s:key>
       <s:key name="type">download-trial</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>enterprise</title>
   <id>https://localhost:8089/services/licenser/stacks/enterprise</id>
   <updated>2011-07-08T10:37:33-07:00</updated>
   <link href="/services/licenser/stacks/enterprise" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/stacks/enterprise" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">... elided ...</s:key>
       <s:key name="label">Splunk Internal License</s:key>
       <s:key name="quota">10737418240</s:key>
       <s:key name="type">enterprise</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>forwarder</title>
   <id>https://localhost:8089/services/licenser/stacks/forwarder</id>
   <updated>2011-07-08T10:37:33-07:00</updated>
   <link href="/services/licenser/stacks/forwarder" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/stacks/forwarder" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">... elided ...</s:key>
       <s:key name="label">Splunk Forwarder</s:key>
       <s:key name="quota">1048576</s:key>
       <s:key name="type">forwarder</s:key>
     </s:dict>
   </content>
 </entry>
 <entry>
   <title>free</title>
   <id>https://localhost:8089/services/licenser/stacks/free</id>
   <updated>2011-07-08T10:37:33-07:00</updated>
   <link href="/services/licenser/stacks/free" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/stacks/free" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">... elided ...</s:key>
       <s:key name="label">Splunk Free</s:key>
       <s:key name="quota">524288000</s:key>
       <s:key name="type">free</s:key>
     </s:dict>
   </content>
 </entry>


licenser/stacks/{name}

https://<host>:<mPort>/services/licenser/stacks/{name}


Get {name} license stack information.


GET

Retrieve details of a specific license stack.

Usage details
A license stack is comprised of one or more licenses of the same "type". The daily indexing quota of a license stack is additive, so a stack represents the aggregate entitlement for a collection of licenses.

Request parameters

None


Returned values

Name Description
label The name of this license stack.
quota The byte quota of this license stack. This value is the sum of the byte quota for all the licenses in the license stack.
type Any additional information about the type of this license stack.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/enterprise

XML Response

<title>stacks</title>
 <id>https://localhost:8089/services/licenser/stacks</id>
 <updated>2011-07-08T10:42:44-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>enterprise</title>
   <id>https://localhost:8089/services/licenser/stacks/enterprise</id>
   <updated>2011-07-08T10:42:44-07:00</updated>
   <link href="/services/licenser/stacks/enterprise" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/stacks/enterprise" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         <s:dict>
           <s:key name="app"></s:key>
           <s:key name="can_write">1</s:key>
           <s:key name="modifiable">0</s:key>
           <s:key name="owner">system</s:key>
           <s:key name="perms">
             <s:dict>
               <s:key name="read">
                 <s:list>
                   <s:item>admin</s:item>
                   </s:list>
               </s:key>
               <s:key name="write">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="sharing">system</s:key>
         </s:dict>
       </s:key>
       <s:key name="eai:attributes"> ... elided ...</s:key>
       <s:key name="label">Splunk Internal License</s:key>
       <s:key name="quota">10737418240</s:key>
       <s:key name="type">enterprise</s:key>
     </s:dict>
   </content>
 </entry>


licenser/usage

https://<host>:<mPort>/services/licenser/usage


Get current license usage stats from the last minute.

GET

Enumerate license usage information from the last minute.


Request parameters
Pagination and filtering parameters can be used with this method.


Returned values

Name Description
quota The byte quota of this license stack. This value is the sum of the byte quota for all the licenses in the active license group.
slaves_usage_bytes Slave usage bytes across all pools that are within the active license group.

Example request and response


XML Request

curl -k -u admin:pass https://localhost:8089/services/licenser/usage

XML Response

  <title>licenseusage</title>
  <id>https://localhost:8089/services/licenser/usage</id>
  <updated>2015-06-03T11:46:10-07:00</updated>
  <generator build="6cfc0237739f" version="6.3.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/licenser/usage/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>license_usage</title>
    <id>https://localhost:8089/services/licenser/usage/license_usage</id>
    <updated>2015-06-03T11:46:10-07:00</updated>
    <link href="/services/licenser/usage/license_usage" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/licenser/usage/license_usage" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="disabled">0</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>*</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list/>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="quota">214748364800</s:key>
        <s:key name="slaves_usage_bytes">0</s:key>
      </s:dict>
    </content>
  </entry>
</feed>


Last modified on 12 October, 2021
KV store endpoint descriptions   Metrics Catalog endpoint descriptions

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters