Splunk Cloud Platform™

Admin Config Service Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Admin Config Service (ACS) API endpoint reference

Use the ACS API endpoint reference to learn about the endpoints and operations that provide programmatic self-service administration for Splunk Cloud Platform.

You must have the sc_admin (Splunk Cloud Platform Administrator) role to use the ACS API.

For more information on ACS API requirements, see ACS requirements and compatibility matrix.

For information on ACS API setup and usage, see Basic setup and usage concepts for the ACS API.

ACS endpoint categories

ACS API endpoints are grouped into the following categories based on feature use case:

Feature Endpoints
Configure IP allow lists access/{feature}/ipallowlists

Configure outbound ports access/outbound-ports

access/outbound-ports/{port}

Enable private connectivity private-connectivity/eligibility

private-connectivity/endpoints

Manage app permissions permissions/apps

permissions/apps/{app-name}

Manage authentication tokens tokens

tokens/{tokenID}

Manage DDSS self storage locations cloud-resources/self-storage-locations/buckets

cloud-resources/self-storage-locations/buckets/{bucketPath}
cloud-resources/self-storage-locations/configs/prefix
cloud-resources/self-storage-locations/buckets/{bucketName}/policy
cloud-resources/self-storage-locations/configs/service-accounts

Manage HTTP Event Collector (HEC) tokens inputs/http-event-collectors

inputs/http-event-collectors/{hec-token-name}

Manage indexes indexes

indexes/{name}

Manage limits.conf configurations limits

limits/{stanza}
limits/{stanza}/{setting}
limits/{stanza}/{reset}

Manage private apps and Splunkbase apps (Victoria Experience) apps/victoria

apps/victoria/{app_name}

Manage private apps and Splunkbase apps (Classic Experience) apps
apps/{app_name}
Manage restarts restart-now
restart/status
Retry failed operations deployment/status
deployment/retry
deployment/status/{deploymentID}
View maintenance windows maintenance-windows/schedules
maintenance-windows/schedules/{scheduleID}

Authentication and authorization

The ACS API requires a JSON Web Token (JWT) for authentication. You can create this token in the Splunk Cloud Platform UI or using the ACS API. For more information see Create an authentication token.

In addition, a user's role must contain the capabilities required to access the ACS API endpoint. The sc_admin role has all required capabilities by default. For more information on using Splunk Cloud Platform role-based access controls with ACS, see Manage ACS API access with capabilities.

Configure IP allowlists

The ACS API provides the following endpoints to configure IP allowlists. For more information on how to configure IP allowlists using the ACS API, see Configure IP allowlists for Splunk Cloud Platform.

access/{feature}/ipallowlists

https://admin.splunk.com/{stack}/adminconfig/v2/access/{feature}/ipallowlists

List, update, and delete IP allow lists.


GET

List subnets on the existing IP allow list for a feature.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
feature String The IP allow list feature type.


Returned values

Name Type Description
subnets String The IP subnets currently listed on the IP allow list for a given feature.

Example request and response

JSON Request 

curl https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists

JSON Response 

{
  "subnets": [
     ": #.0.0.0/24",
     ": #.0.0.0/24",
     ": #.0.10.6/32"
  ]
}

POST

Add subnets to the IP allow list for a feature.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
feature String The IP allow list feature type.
subnets String List of subnets to add to IP allow list


Returned values
None


Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--data '{
"subnets": [
"###.0.0.0/24",
"##.0.10.6/32"
]
}'

JSON Response 

{
"code": "200"
}

DELETE

Delete subnets from the IP allow list for a feature


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
feature String The IP allow list feature type.
subnets String List of subnets to delete from IP allow list


Returned values
None


Example request and response

JSON Request 

curl -X DELETE 'https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2Vj...' \
--header 'Content-Type: application/json' \
--data '{
"subnets": [
"###.0.0.0/24",
"##.0.10.6/32"
]
}'

JSON Response 

{
"code": "200"
}

Configure outbound ports

access/outbound-ports

https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports

List and create outbound ports.


GET

List existing outbound ports.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
name String The outbound port name.
port Number The outbound port number.
destinationRanges String The allowed destination IP subnets for the outbound port.
reason String The purpose for the outbound port.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/access/outbound-ports' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response 

[
   {
       "destinationRanges": [
           "34.226.34.80/32",
           "54.226.34.80/32"
       ],
       "name": "8089",
       "port": 8089
   },
   {
       "destinationRanges": [
           "4.16.171.10/32"
       ],
       "name": "8590",
       "port": 8590
   }
]

POST

Create an outbound port.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
outboundPorts String The outbound port number and destination subnets.
port Number The outbound port number.
subnets String The allowed destination subnets for the outbound port.
reason String The purpose of the outbound port.


Returned values

Name Type Description
outboundPorts String The outbound port number and destination subnets.
port Number The outbound port number.
subnets String The allowed destination subnets for the outbound port.
reason String The purpose of the outbound port.

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/access/outbound-ports' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'  \
--data-raw '{
   "outboundPorts": [{"subnets": ["34.226.34.80/32", "54.226.34.80/32"], "port": 8089}],
   "reason": "testing federated search connection"
}'

JSON Response 

{
   "outboundPorts": [
       {
           "port": 8089,
           "subnets": [
               "34.226.34.80/32",
               "54.226.34.80/32"
           ]
       }
   ],
   "reason": "testing federated search connection"

access/outbound-ports/{port}

https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports/{port}

Describe and delete outbound ports.


GET

Describe an outbound port.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
port Number The outbound port number.


Returned values

Name Type Description
destinationRanges String The allowed destination IP subnets for the outbound port.
name String The outbound port name.
port Number The outbound port number.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports/8089' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
   "destinationRanges": [
       "34.226.34.80/32",
       "54.226.34.80/32"
   ],
   "name": "8089",
   "port": 8089
}

DELETE

Delete an outbound port.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
subnets String The allowed destination IP subnets for the outbound port.


Returned values

Name Type Description
subnets String The deleted destination IP subnets for the outbound port.


Example request and response

JSON Request 

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports/8089' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--header 'Content-Type: application/json' \
--data-raw '{
"subnets": ["54.203.114.197/32", "34.226.34.80/32"]
}'

JSON Response 

{
   "subnets": [
       "54.203.114.197/32",
       "34.226.34.80/32"
   ]
}

Manage app permissions

permissions/apps

https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps

List app permissions.

GET

List read and write permissions assigned to roles for all apps.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
count Number Specifies the maximum number of items to list. Maximum value is 100. Default is 30. A value of 0 lists all items.
offset Number Specifies a count displacement value (from the first existing item) on which to start the list. For example, if the count value is 100, to list items 100-200, specify an offset value of 100.


Returned values

Name Type Description
name String The app name.
read String List of roles with app read permission.
write String List of roles with app write permission.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps?count={{count}}&offset={{offset}}' \
--header 'Authorization: Bearer eyJraWQi0iJzcGX1...'

JSON Response 

{
    "apps": [
        {
            "name": "app1",
            "perms": {
                "read": [
                    "*"
                ],
                "write": [
                    "*"
                ]
            }
        },
        {
            "name": "app2",
            "perms": {
                "read": [
                    "*"
                ],
                "write": [
                    "admin"
                ]
            }
        },
        {
            "name": "app3",
            "perms": {
                "read": [
                    "*"
                ],
                "write": [
                    "admin"
                ]
            }
        }
    ]
}

permissions/apps/{app-name}

https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps/{app-name}

View and configure read and write permissions for individual apps.

GET

View read and write permissions assigned to roles for an individual app.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
app-name String The app name.


Returned values

Name Type Description
name String The app name.
read String List of roles assigned app read permission.
write String List of roles assigned app write permission.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps/{app-name}' \
--header 'Authorization: Bearer eyJraWQi0iJzcGX1...'

JSON Response 

{
    "name": "APP-NAME",
    "perms": {
        "read": [
            "admin",
            "power"
        ],
        "write": [
            "admin"
        ]
    }
}


PATCH

Assign read and write permissions to roles for an individual app.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
app-name String The app name.
read String List of roles to assign app read permission.
write String List of roles to assign app write permission.


Returned values

Name Type Description
name String The app name.
read String Updated list of roles assigned app read permission.
write String Updated list of roles assigned app write permission.

Example request and response

JSON Request 

curl -X PATCH 'https://admin.splunk.com/{stack}//adminconfig/v2/permissions/apps/{app_name}' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{token}}' \
--data '{
    "read": ["admin", "power"],
    "write": ["admin"]
} 
'

JSON Response 

{
    "name": "acs_test_app_1",
    "perms": {
        "read": [
            "admin",
            "power"
        ],
        "write": [
            "admin"
        ]
    }
}

Manage DDSS storage locations

cloud-resources/self-storage-locations/buckets

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/buckets

List self storage locations.


GET

List existing self storage locations.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
bucketName String The self storage bucket name in AWS or GCP.
bucketPath String A unique identifier combining bucketName and folder.
title String The title of the self storage location in Splunk Cloud Platform.
description String A description of the self storage location.
folder String The self storage bucket folder.
uri String The URI of the self storage location in AWS or GCP.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
    "selfStorageLocations": [
        {
            "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
            "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/dup-title-ui",
            "description": "Test dupilcate title from UI",
            "folder": "dup-title-ui",
            "title": "test-bucket-1-with-message",
            "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/dup-title-ui"
        },
        {
            "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
            "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder",
            "description": "Test",
            "folder": "some-folder",
            "title": "test-bucket-1-with-message",
            "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder"
        },
        {
            "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
            "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message",
            "description": "Test configuring ddss with ACS and show async message",
            "folder": "with-message",
            "title": "test-bucket-1-with-message",
            "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message"
        }
    ]
}


POST

Configure self storage locations in AWS or GCP.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
bucketName String The self storage bucket name in AWS or GCP.
title String The title of the self storage location in Splunk Cloud Platform.
description String (Optional) A description of the self storage location.
folder String (Optional) The self storage bucket folder.


Returned values

Name Type Description
bucketName String The self storage bucket name in AWS or GCP.
bucketPath String A unique identifier combining bucketName and folder.
title String The title of the self storage location in Splunk Cloud Platform.
description String A description of the self storage location.
folder String The self storage bucket folder.
uri String The URI of the self storage location in AWS or GCP.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

For AWS S3: 

{
    "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
    "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message",
    "description": "Test configuring ddss with ACS and show async message",
    "folder": "with-message",
    "title": "test-bucket-1-with-message",
    "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message"
}

For GCP GCS: 

{
    "bucketName": "indexes-acs-gcp-ic1l-bucket",
    "bucketPath": "indexes-acs-gcp-ic1l-bucket/untitled-folder",
    "description": "Test configuring ddss with ACS on GCP Stack",
    "folder": "untitled-folder",
    "title": "test-bucket-for-gcp",
    "uri": "gs://indexes-acs-gcp-ic1l-bucket/untitled-folder"
}



cloud-resources/self-storage-locations/buckets/{bucketPath}

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/buckets/{bucketPath}

Describe self storage locations.


GET

Describe a self storage location.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
bucketPath String A unique identifier combining bucketName and folder. Must be URL encoded. For example, acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder must be passed as acs-play-noah-aws-iycf10l9z5nl-bucket-1%2Fsome-folder.


Returned values

Name Type Description
bucketName String The self storage bucket name in AWS or GCP.
bucketPath String A unique identifier combining bucketName and folder.
title String The title of the self storage location in Splunk Cloud Platform.
description String A description of the self storage location.
folder String The self storage bucket folder.
uri String The URI of the self storage location in AWS or GCP.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets/acs-play-noah-aws-iycf10l9z5nl-bucket-1%2Fsome-folder' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

For AWS deployments:'" 

{
    "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
    "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder",
    "description": "Test",
    "folder": "some-folder",
    "title": "test-bucket-1-with-message",
    "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder"
}

For GCP deployments:'" 

{
    "bucketName": "acs-play-noah-gcp-ic1l-bucket",
    "bucketPath": "acs-play-noah-gcp-ic1l-bucket/some-folder",
    "description": "Test",
    "folder": "some-folder",
    "title": "test-bucket-with-message",
    "uri": "gs://acs-play-noah-gcp-ic1l-bucket/some-folder"
}



cloud-resources/self-storage-locations/configs/prefix

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/configs/prefix

Get prefix to configure a bucket.


GET

Get prefix to configure a bucket.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
message String Bucket prefix syntax reminder.
prefix String The predefined bucket name prefix provided by Splunk Cloud Platform.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/configs/prefix' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
    "message": "Please create a bucket in the same region as your Splunk Cloud environment. The bucket must have 'acs-play-noah-aws-iycf10l9z5nl-' as the prefix in the name",
    "prefix": "acs-play-noah-aws-iycf10l9z5nl-"
}



cloud-resources/self-storage-locations/buckets/{bucketName}/policy

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/buckets/{bucketName}/policy

Get IAM policy for AWS S3 bucket.


GET

Get IAM policy for AWS S3 bucket.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
bucketName String The name of the AWS S3 bucket.


Returned values

Name Type Description
message String Reminder that you must apply the IAM policy to your S3 bucket in AWS.
policy String The IAM policy for the specified AWS S3 bucket.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets/{bucketName}/policy' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
    "message": "Please copy and apply this bucket policy to your S3 bucket in AWS. Please refer to https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/DataSelfStorage for more info.",
    "policy": {
        "Statement": [
            {
                "Action": [
                    "s3:PutObject",
                    "s3:ListBucket"
                ],
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::594195655983:role/acs-play-noah-aws"
                },
                "Resource": [
                    "arn:aws:s3:::acs-play-noah-aws-iycf10l9z5nl-some-bucket",
                    "arn:aws:s3:::acs-play-noah-aws-iycf10l9z5nl-some-bucket/*"
                ]
            }
        ],
        "Version": "2012-10-17"
    }
}



cloud-resources/self-storage-locations/configs/service-accounts

https://admin.splunk.com/{stack}/adminconfig/v2/cloud-resources/self-storage-locations/configs/service-accounts

Get service accounts for GCP GCS bucket.


GET

Get service accounts for GCP GCS bucket.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
message String Reminder that you must configure proper permissions for GCP service accounts.
serviceAccounts String The two service accounts associated with your Splunk Cloud Platform deployment in GCP.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/configs/service-accounts' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
    "message": "Please configure proper permissions for the GCP service accounts. Please refer to https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/DataSelfStorage for more info.",
    "serviceAccounts": {
        "clusterMaster": "indexes-acs-gcp-c0m1@indexes-acs-gcp-cdf8.iam.gserviceaccount.com",
        "indexer": "indexes-acs-gcp-idx@indexes-acs-gcp-cdf8.iam.gserviceaccount.com"
    }
}

Manage authentication tokens

tokens

https://admin.splunk.com/{stack}/adminconfig/v2/tokens

View and create JWT authentication tokens.


GET

View existing JWT tokens.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
count Number Specifies the maximum number of items to list. Maximum value is 100. Default is 30. A value of 0 lists all items.
offset Number Specifies a count displacement value (from the first existing item) on which to start the list. For example, if the count value is 100, to list items 100-200, specify an offset value of 100.
username String Specifies user whose tokens will be listed.
status String Specifies whether to return "enabled" or "disabled" tokens. Must be either "enabled" or "disabled".


Returned values

Name Type Description
user String The name of the token user.
audience String The purpose of the token.
id String The token ID.
status String The status of token authentication.
expiresOn String The time the token will expire. Time is UTC.
notBefore String The time you can start to use the token. Default is now. Time is UTC.
lastUsed String The time the token was last used. Time is UTC.
lastUsedIP String The IP address of the instance on which the token was last used.


Example request and response

JSON Request 

curl -X GET 'https://admin.splunk.com/{stack}/adminconfig/v2/tokens/' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi...'

JSON Response 

[
     {
          "id": "d9637736177efc773ec8c5c04efcc2e19859cd852af00689ef81bf9e809364a8",
          "user": "admin",
          "audience": "acs-test",
          "status": "enabled",
          "expiresOn": "2021-11-19T00:34:46Z",
          "notBefore": "2021-10-20T00:34:46Z",
          "lastUsed": "2021-10-20T03:52:53Z",
          "lastUsedIP": "50.216.96.2"
     },
     {
          "id": "a9637736177efc773ec8c5c04efcc2e19859cd852af00689ef81bf9e80936984",
          "user": "admin",
          "audience": "acs-test2",
          "status": "enabled",
          "expiresOn": "2022-05-19T00:34:46Z",
          "notBefore": "2022-04-20T00:34:46Z",
          "lastUsed": "2022-04-24T03:52:53Z",
          "lastUsedIP": "45.216.96.2"
     }
]

POST

Create a new token.


Request parameters

Name Type Description
username String The login username for the Splunk Cloud Platform instance.
password String The login password for the Splunk Cloud Platform instance.
user String The name of the token user. Must be an existing user.
audience String The purpose of the token.
type String Accepts values of "ephemeral" or "static". A value of "ephemeral" creates a token with default expiresOn value of 6 hours. A value of "static" means there is no effect on the existing expiresOn value, which defaults to +30d.
expiresOn String The amount of time until the token expires. You can specify this value in relative time (+<number>[s][m][h][d]) or absolute time (YYYY-MM-DDTHH:MM:SS[+HH:MM]). Default is +30d. Time is UTC.


Returned values

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
user String The name of the token user.
audience String The purpose of the token.
id String The token ID.
status String The status of token authentication.
expiresOn String The time the token will expire. Time is UTC.
notBefore String The time you can start to use the token. Default is now. Time is UTC.

Example request and response

JSON Request 

curl -u username:password -X POST 'https://admin.splunk.com/keziabutterfinger/adminconfig/v2/tokens' \
--header 'Content-Type: application/json' \
--data-raw '{
  "user" : "admin",
  "audience" : "acs-test",
  "expiresOn" : "+100d"
}'
}'

JSON Response 

   "user": "admin",
   "audience": "acs-test",
   "id": "0c1daac93fd01bc50cfe8ed938ce401bc168a8730c1c9e2f343671541e759fbf",
   "token": "eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnIjoiSFM1MTIiLCJ2ZXIiOiJ2MiIsInR0eXAiOiJzdGF0aWMifQ.eyJpc3MiOiJhZG1pbiBmcm9tIHNoLWktMGJlMzJiYTM1YjY4MDlhMDEiLCJzdWIiOiJhZG1pbiIsImF1ZCI6Imtlei10ZXN0IiwiaWRwIjoiU3BsdW5rIiwianRpIjoiMzA0YmEzYWQxOWMwOWRhYmYxYzljY2YzYTcxMTM3NTQ1NmFiODM0ZDljMjBjN2E3MzYzNWUyYWMxNmQ5OWFiMSIsImlhdCI6MTYzNDA2NjAzMSwiZXhwIjoxNjM2NjU4MDMxLCJuYnIiOjE2MzQwNjYwMzF9.Cml1yQMXgo18dauOuORTc4vTxm1tWuXOL6sBj0TEV1lwOIqo5sCBKv_B45Jjb34XkK-TJQgdYqcOoV0un-ARDQ",
   "status": "enabled",
   "expiresOn": "2021-12-16T21:37:11Z",
   "notBefore": "2021-11-16T21:37:11Z"

tokens/{id}

https://admin.splunk.com/{stack}/adminconfig/v2/access/tokens/{id}

View and delete individual tokens.


GET

View a token.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
id String The token ID.


Returned values

Name Type Description
user String The name of the token user.
audience String The purpose of the token.
id String The token ID.
status String The status of token authentication.
expiresOn String The time the token will expire. Time is UTC.
notBefore String The time you can start to use the token. Default is now. Time is UTC.
lastUsed String The time the token was last used. Time is UTC.
lastUsedIP String The IP address of the instance on which the token was last used.


Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/tokens/55ee3d1c199645c330d28dcd9fa50bc6e9f74154c3d1c3d31229b6e78be77ed7' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
   "id": "d9637736177efc773ec8c5c04efcc2e19859cd852af00689ef81bf9e809364a8",
   "user": "admin",
   "audience": "acs-test",
   "status": "enabled",
   "expiresOn": "2021-11-19T00:34:46Z",
   "notBefore": "2021-10-20T00:34:46Z",
   "lastUsed": "2021-10-20T03:52:53Z",
   "lastUsedIP": "50.216.96.2"
}

DELETE

Delete a token.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
id String The token ID.


Returned values
None

Example request and response

JSON Request 

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/tokens/55ee3d1c199645c330d28dcd9fa50bc6e9f74154c3d1c3d31229b6e78be77ed7' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
"code": "200"
}

Manage HTTP Event Collector (HEC) tokens

The ACS API provides the following endpoints to manage HEC tokens. For more information on how to manage HEC tokens using the ACS API, see Manage HTTP Event Collector (HEC) tokens in Splunk Cloud Platform.

ACS endpoints for HEC token management apply to deployments on Victoria Experience only. See Determine your Splunk Cloud Platform Experience.

inputs/http-event-collectors

https://admin.splunk.com/{stack}/adminconfig/v2/inputs/http-event-collectors

List and create HEC tokens.


GET

List existing HEC tokens.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
count Number Specifies the maximum number of items to list. Maximum value is 100. Default is 30. A value of 0 lists all items.
offset Number Specifies a count displacement value (from the first existing item) on which to start the list. For example, if the count value is 100, to list items 100-200, specify an offset value of 100.


Returned values

Name Type Description
name String The HEC token name. This is the token ID, not the actual token value.
disabled Boolean The enabled/disabled status of the HEC token.
defaultindex String Default index to store generated events.
useACK Boolean (Optional) Enable/disable (true/false) indexer acknowledgement.
token String The full token value.

Example request and response

JSON Request 

curl https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors

JSON Response 

{
   "http-event-collectors": [
       {
           "spec": {
               "allowedIndexes": [
                   "main",
                   "summary"
               ],
               "defaultHost": "",
               "defaultIndex": "main",
               "defaultSource": "",
               "defaultSourcetype": "",
               "disabled": true,
               "name": "hec-token-name",
               "useACK": true 
           },
           "token": "9803a48f-b733-4106-8a3f-871c53ee2675"
       }
   ]
}

POST

Create a new HEC token.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
name String The HEC token name. This is the token ID, not the actual token value.
defaultIndex String Default index to store generated events.
useACK Boolean (Optional) Enable/disable (true/false) indexer acknowledgement.
token String (Optional) An existing token value.


Returned values

Name Type Description
token String The full token value.

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/mystack/adminconfig/v2/inputs/http-event-collectors' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--header 'Content-Type: application/json' \
--data-raw '{
   "allowedIndexes": [
       "main",
       "summary"
   ],
   "defaultHost": "",
   "defaultIndex": "main",
   "defaultSource": "",
   "defaultSourcetype": "",
   "disabled": false,
   "name": "hec-token-name",
   "useACK": true,
   "token": "this_is_my_token"
}'

JSON Response 

"http-event-collector": {
       "spec": {
           "allowedIndexes": [
               "main",
               "summary"
           ],
           "defaultHost": "",
           "defaultIndex": "main",
           "defaultSource": "",
           "defaultSourcetype": "",
           "disabled": false,
           "name": "hec-token-name"
           "UseACK": true
       },
       "token": "this_is_my_token"
   }
}

inputs/http-event-collectors/{hec-token-name}

https://admin.splunk.com/{stack}/adminconfig/v2/inputs/http-event-collectors/{hec-token-name}

View, update, and delete HEC tokens.


GET

View an inidvidual HEC token.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
name String The HEC token name. This is the token ID, not the actual token value.


Returned values

Name Type Description
disabled Boolean The enabled/disabled status of the HEC token.
defaultindex String Default index to store generated events.
useACK Boolean (Optional) Enable/disable (true/false) indexer acknowledgement.
token String The full token value.

Example request and response

JSON Request 

curl https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors/{hec-token-name}

JSON Response 

{
   "http-event-collectors": [
       {
           "spec": {
               "allowedIndexes": [
                   "main",
                   "summary"
               ],
               "defaultHost": "",
               "defaultIndex": "main",
               "defaultSource": "",
               "defaultSourcetype": "",
               "disabled": true,
               "name": "hec-token-name"
           },
           "token": "9803a48f-b733-4106-8a3f-871c53ee2675"
       }
   ]
}

PUT

Update an existing HEC token.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
defaultHost String Default index to store generated events.
defaultIndex String Default event source.
defaultSource String Default index to store generated events.
defaultSourcetype String Default index to store generated events.
disabled String Default index to store generated events.
name String The name of the HEC token. This is the token ID, not the actual token value.
useACK Boolean (Optional) Enable/disable (true/false) indexer acknowledgement.


Returned values
None

Example request and response

JSON Request 

curl -X PUT 'https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--header 'Content-Type: application/json' \
--data-raw '{
   "allowedIndexes": [
       "main",
       "summary"
   ],
   "defaultHost": "",
   "defaultIndex": "main",
   "defaultSource": "",
   "defaultSourcetype": "",
   "disabled": false,
   "name": "hec-token-name"
}'

JSON Response 

{
"code": "200"
}

DELETE

Delete an HEC token.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
name String The HEC token name. This is the token ID, not the actual token value.


Returned values
None


Example request and response

JSON Request 

curl -X DELETE 'https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--header 'Content-Type: application/json' \

JSON Response 

{
"code": "200"
}

Manage indexes

The ACS API provides the following endpoints to manage indexes. For more information on how to manage indexes using the ACS API, see Manage indexes in Splunk Cloud Platform.

ACS supports index management on Splunk Cloud Platform deployments on both Victoria Experience and Classic Experience.

indexes

https://admin.splunk.com/{stack}/adminconfig/v2/indexes

List and create indexes.


GET

List existing indexes.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
count Number Specifies the maximum number of items to list. Maximum value is 100. Default is 30. A value of 0 lists all items.
offset Number Specifies a count displacement value (from the first existing item) on which to start the list. For example, if the count value is 100, to list items 100-200, specify an offset value of 100.


Returned values

Name Type Description
name String The index name.
datatype String The type of data the index holds. Possible values: event or metric
searchableDays Number Number of days the index is searchable.
maxDataSizeMB Number The maximum size of the index in megabytes.
totalEventCount Number The total number of events in an index.
totalRawSizeMB Number The total amount of raw data in an index in megabytes.
splunkArchivalRetentionDays Number The archive retention period for indexes enabled with Dynamic Data Active Archive (DDAA).
selfStorageBucketPath String The self-storage location for indexes enabled with Dynamic Data Self Storage (DDSS).

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/indexes'

JSON Response 

[
   {
       "name": "history",
       "datatype": "event",
       "searchableDays": 7,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "lastchanceindex",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "main",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "splunklogger",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "summary",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   }
]

POST

Create a new index.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud deployment.
name String The index name.
datatype String The type of data the index holds. Possible values: event or metric.
searchableDays Number Number of days the index is searchable.
maxDataSizeMB Number The maximum size of the index in megabytes.
splunkArchivalRetentionDays Number The archive retention period for indexes enabled with Dynamic Data Active Archive (DDAA). Specifying this value enables DDAA for the index.
selfStorageBucketPath String The self-storage location for indexes enabled with Dynamic Data Self Storage (DDSS). Specifying this value enables DDSS for the index. Note: Before you can create an index with DDSS enabled, you must configure a self-storage location for your deployment.


Returned values

Name Type Description
name String The index name.
datatype String The type of data the index holds. Possible values: event or metric
searchableDays Number Number of days the index is searchable.
maxDataSizeMB Number The maximum size of the index in megabytes.
totalEventCount Number The total number of events in an index.
totalRawSizeMB Number The total amount of raw data in an index in megabytes.
splunkArchivalRetentionDays Number The archive retention period for indexes enabled with Dynamic Data Active Archive (DDAA).
selfStorageBucketPath String The self-storage location for indexes enabled with Dynamic Data Self Storage (DDSS).

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/indexes'
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' \
--header 'Content-Type: application/json' \
--data-raw '{
   "name": "testindex"
}'

JSON Response 

{
   "name": "testindex",
   "datatype": "event",
   "searchableDays": 90,
   "maxDataSizeMB": 0,
   "totalEventCount": "0",
   "totalRawSizeMB": "0"
}

indexes/{name}

https://admin.splunk.com/{stack}/adminconfig/v2/indexes/{name}

View, update, and delete indexes.


GET

View an individual index.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
name String The name of the index.


Returned values

Name Type Description
name String The index name.
datatype String The type of data the index holds. Possible values: event or metric
searchableDays Number Number of days the index is searchable.
maxDataSizeMB Number The maximum size of the index in megabytes.
totalEventCount Number The total number of events in an index.
totalRawSizeMB Number The total amount of raw data in an index in megabytes.
splunkArchivalRetentionDays Number The archive retention period for indexes enabled with Dynamic Data Active Archive (DDAA).
selfStorageBucketPath String The self-storage location for indexes enabled with Dynamic Data Self Storage (DDSS).

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/indexes/testindex' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
   "name": "testindex",
   "datatype": "event",
   "searchableDays": 90,
   "maxDataSizeMB": 1024,
   "totalEventCount": "0",
   "totalRawSizeMB": "0"
}

PATCH

Update an existing index.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
name String The name of the index.
searchableDays Number Number of days the index is searchable.
maxDataSizeMB Number The maximum size of the index in megabytes.
splunkArchivalRetentionDays Number The archive retention period for indexes enabled with Dynamic Data Active Archive (DDAA). Specifying this value enables DDAA, or modifies the archive retention period value for an index already enabled with DDAA.
selfStorageBucketPath String The self-storage location for indexes enabled with Dynamic Data Self Storage (DDSS). Specifying this value enables DDSS, or modifies the self-storage location for an index already configured with DDSS. Note: Before you can create an index with DDSS enabled, you must configure a self-storage location for your deployment.


Returned values
None

Example request and response

JSON Request 

curl -X PATCH 'https://admin.splunk.com/lighthearted-lemur-23e/adminconfig/v2/indexes/testindex' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' \
--data-raw '{
   "searchableDays": 90,
   "maxDataSizeMB": 1024
}'

JSON Response 

{
   "name": "testindex",
   "datatype": "event",
   "searchableDays": 90,
   "maxDataSizeMB": 1024,
   "totalEventCount": "0",
   "totalRawSizeMB": "0"
}

DELETE

Delete an index.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
name String The name of the index.


Returned values
None


Example request and response

JSON Request 

curl -X DELETE 'https://admin.splunk.com/lighthearted-lemur-23e/adminconfig/v2/indexes/testindex' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
"code": "200"
}

Manage limits.conf configurations

The ACS API provides the following endpoints to manage limits.conf configurations. ACS API operations apply to a subset of editable limits.conf settings only. For more information on how to manage limits.conf configurations using the ACS API, see Manage limits.conf configurations in Splunk Cloud Platform.

ACS endpoints for managing limits.conf apply to deployments on Victoria Experience only. See Determine your Splunk Cloud Platform Experience.

limits

https://admin.splunk.com/{stack}/adminconfig/v2/limits

List all limits.conf settings.


GET

List all limits.conf settings.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
Stanza String Name of limits.conf stanza.
Values String Limits.conf settings and current values.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response 

[{"Stanza":"join","Values":{"subsearch_maxout":"91519","subsearch_maxtime":"111","subsearch_timeout":"120"}},{"Stanza":"kv","Values":{"limit":"100","maxchars":"182"}},{"Stanza":"subsearch","Values":{"maxout":"10000","maxtime":"60"}}]

limits/{stanza}

https://admin.splunk.com/{stack}/adminconfig/v2/limits/{stanza}

List and edit limits.conf settings under a stanza.


GET

List limits.conf settings under a stanza.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
stanza String Name of limits.conf stanza.


Returned values

Name Type Description
settings String Limits.conf settings and values under the stanza.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response 

{"subsearch_maxout":"91519","subsearch_maxtime":"111","subsearch_timeout":"120"}

POST

Edit limits.conf settings.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
stanza String Name of limits.conf stanza.
settings String Limits.conf settings and modified values under the stanza.


Returned values

Name Type Description
settings String Limits.conf settings and values under the stanza.

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "settings": {
        "subsearch_maxout": 91519,
        "subsearch_maxtime": 111
    }
}'

JSON Response 

{"settings":{"subsearch_maxout":91519,"subsearch_maxtime":111}}

limits/{stanza}/{setting}

https://admin.splunk.com/{stack}/adminconfig/v2/limits/{stanza}/{setting}

List a specific limits.conf setting under a stanza.


GET

List a specific limits.conf setting under a stanza.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
stanza String Name of limits.conf stanza.
setting String Name of limits.conf setting.


Returned values

Name Type Description
setting String Limits.conf setting and value.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join/susearch_maxout \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response 

{"subsearch_maxout":"91519"}

limits/defaults

https://admin.splunk.com/{stack}/adminconfig/v2/limits/defaults

List all supported stanzas and default values for all settings within each stanza.


GET

List all supported limits.conf stanzas and default settings.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
stanza String Name of limits.conf stanza.
settings String limits.conf settings and their default values.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/defaults \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response 

[
	{
		"stanza": "join",
		"settings": [
			{
				"setting": "subsearch_maxout",
				"minValue": 0,
				"maxValue": 100000,
				"defaultValue": 50000
			},
			{
				"setting": "subsearch_maxtime",
				"minValue": 0,
				"maxValue": 120,
				"defaultValue": 60
			},
			{
				"setting": "subsearch_timeout",
				"minValue": 0,
				"maxValue": 240,
				"defaultValue": 120
			}
		]
	},
    ...
]

limits/{stanza}/defaults

https://admin.splunk.com/{stack}/adminconfig/v2/limits/{stanza}/defaults

List default values for settings in a specific stanza.


GET

List default values for settings in a specific limits.conf stanza


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
stanza String Name of limits.conf stanza.


Returned values

Name Type Description
stanza String Name of limits.conf stanza.
settings String limits.conf settings and their default values.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/subsearch/defaults \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response 

{
	"stanza": "subsearch",
	"settings": [
		{
			"setting": "maxout",
			"minValue": 0,
			"maxValue": 10400,
			"defaultValue": 10000
		},
		{
			"setting": "maxtime",
			"minValue": 0,
			"maxValue": 120,
			"defaultValue": 60
		}
	]
}

limits/{stanza}/reset

https://admin.splunk.com/{stack}/adminconfig/v2/access/limits/{stanza}/reset

Reset a specific setting or all settings under a stanza.


POST

Reset a specific setting or all settings under a stanza


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
stanza String Name of limits.conf stanza.
setting String Specific limits.conf setting to reset (specify in request body)


Returned values

Name Type Description
settings String Limits.conf settings reset to default values

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join/reset' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{"settings":{"subsearch_maxout":50000,"subsearch_maxtime":60,"subsearch_timeout":120}}

Manage private apps and Splunkbase apps (Victoria Experience)

The ACS API provides the following endpoints to manage private apps and Splunkbase apps. For more information on how to manage private apps using the ACS API, see Manage private apps in Splunk Cloud Platform. For more information on how to manage Splunkbase apps using the ACS API, see Manage Splunkbase apps in Splunk Cloud Platform

The following ACS endpoints for managing private apps and Splunkbase apps apply to deployments on Victoria Experience only. See Determine your Splunk Cloud Platform Experience.

apps/victoria

https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria

List and install apps (Victoria Experience).

Authentication and authorization

  • All GET and POST operations for this endpoint require a JWT authentication token.
  • POST operations to install private apps also require an AppInspect authentication token and a legal acknowledgement that you accept risk for unsupported apps. For more information, see Manage private apps using the ACS API on Victoria Experience.
  • POST operations to install Splunkbase apps also require a Splunkbase session ID and the Splunkbase app license URL. For more information, see Manage Splunkbase apps using the ACS API.

GET

List apps.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
count Number Specifies the maximum number of items to list. Maximum value is 100. Default is 30. A value of 0 lists all items.
offset Number Specifies a count displacement value (from the first existing item) on which to start the list. For example, if the count value is 100, to list items 100-200, specify an offset value of 100.
splunkbase Boolean Specify splunkbase=true to list Splunkbase apps only. Specify splunkbase=false to list non-Splunkbase apps only. If you do not specify this parameter, ACS lists all apps.


Returned values

Name Type Description
label String The app label.
name String The app name.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID Number The Splunkbase app ID number

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria'
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…'

JSON Response 

{
   "apps": [
       {
           "label": "075-cloudworks",
           "name": "075-cloudworks",
           "status": "installed",
           "version": ""
       },
       {
           "label": "100-cloudworks-wlm",
           "name": "100-cloudworks-wlm",
           "status": "installed",
           "version": ""
       },


       {
           "label": "tos",
           "name": "tos",
           "status": "installed",
           "version": ""
       }
   ]
}

POST

Install an app.


Request parameters

stack String The URL prefix of the Splunk Cloud Platform deployment.
splunkbase Boolean You must specify splunkbase=true to install Splunkbase apps.
splunkbaseID Number The Splunkbase app ID number. You can find the splunkbaseID value in the URL of the Splunkbase app download page.

Returned values

Name Type Description
label String The app label.
name String The app name.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID String The Splunkbase app ID number.

Example request and response (install private app)

JSON Request 

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria' \
--header 'X-Splunk-Authorization: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9…' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-binary '@/Users/croth/Downloads/pa1v20.tar.gz'

JSON Response 

{
   "label": "pa1",
   "name": "pa1",
   "status": "installed",
   "version": "1.2.2"
}


Example request and response (install Splunkbase app)

JSON Request 

curl -X POST 'https:/admin.splunk.com/{stack}/adminconfig/v2/apps/victoria?splunkbase=true' \
--header 'X-Splunkbase-Authorization: bgf4ztyxcgssgcbdrhguzl0xgousxzcq' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'ACS-Licensing-Ack: http://opensource.org/licenses/ISC' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-urlencode 'splunkbaseID=491'

JSON Response 

{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.4"
}

apps/victoria/{app_name}

https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/{app_name}

Describe and uninstall apps. Upgrade or downgrade Splunkbase apps. (Victoria Experience)

Authentication and authorization

  • All GET, PATCH, and DELETE operations for this endpoint require a JWT authentication token.
  • PATCH operations to upgrade or downgrade Splunkbase apps also require a Splunkbase session ID and the Splunkbase app license URL. For more information, see Manage Splunkbase apps using the ACS API.

GET

Describe an app.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
app_name String The name of the app.


Returned values

Name Type Description
label String The app label.
name String The app name.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID String The Splunkbase app ID number.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
   "label": "testapp",
   "name": "testapp",
   "status": "installed",
   "version": ""
}

PATCH

Upgrade or downgrade a Splunkbase app.


Request parameters

stack String The URL prefix of the Splunk Cloud Platform deployment.
splunkbase Boolean You must specify splunkbase=true in the request URL to upgrade Splunkbase apps.
splunkbaseID Number The Splunkbase app ID number. You can find the splunkbaseID value in the URL of the Splunkbase app download page.

Returned values

Name Type Description
label String The app label.
name String The app name.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID String The Splunkbase app ID number.

Example request and response

JSON Request 

curl -X PATCH 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/SplunkforPaloAltoNetworks' \
--header X-Splunkbase-Authorization: bgf4ztyxcgssgcbdrhguzl0xgousxzcq' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'ACS-Licensing-Ack: http://opensource.org/licenses/ISC' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-urlencode 'version=7.0.3'

JSON Response 

{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.3"
}

DELETE

Uninstall an app.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
app_name String The name of the app.


Returned values
None


Example request and response

JSON Request 

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response
None

Manage private apps and Splunkbase apps (Classic Experience)

apps

https://admin.splunk.com/{stack}/adminconfig/v2/apps

List and install apps (Classic Experience).

Authentication and authorization


GET

List apps.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
count Number Specifies the maximum number of items to list. Maximum value is 100. Default is 30. A value of 0 lists all items.
offset Number Specifies a count displacement value (from the first existing item) on which to start the list. For example, if the count value is 100, to list items 100-200, specify an offset value of 100.
splunkbase Boolean Specify splunkbase=true to list Splunkbase apps only. Specify splunkbase=false to list non-Splunkbase apps only. If you do not specify this parameter, ACS lists all apps.


Returned values

Name Type Description
label String The app label.
name String The app name.
package String The app installation package.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID Number The Splunkbase app ID number

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps?count=100' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…'

JSON Response 

{
   "apps": []
}

POST

Install an app.


Request parameters

stack String The URL prefix of the Splunk Cloud Platform deployment.
splunkbase Boolean You must specify splunkbase=true to install Splunkbase apps.
splunkbaseID Number The Splunkbase app ID number. You can find the splunkbaseID value in the URL of the Splunkbase app download page.


Returned values

Name Type Description
label String The app label.
name String The app name.
package String The app installation package.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID String The Splunkbase app ID number.

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/apps' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--form 'token="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9…"' \
--form 'package=@"/Users/{name}/app_inspect/testapp.tar.gz"'

JSON Response 

{
   "label": "testapp",
   "name": "testapp",
   "package": "testapp.tar.gz",
   "status": "installed",
   "version": "1.0.31"
}

apps/{app_name}

https://admin.splunk.com/{stack}/adminconfig/v2/apps/{app_name}

Describe, upgrade, and uninstall apps (Classic Experience).

Authentication and authorization

  • All GET, PATCH, and DELETE operations for this endpoint require a JWT authentication token.
  • PATCH operations to upgrade or downgrade Splunkbase apps also require a Splunkbase session ID and the Splunkbase app license URL. For more information, see Upgrade a Splunkbase app on Classic Experience.

GET

Describe an app.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
app_name String The name of the app.


Returned values

Name Type Description
label String The app label.
name String The app name.
package String The app installation package.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID String The Splunkbase app ID number.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response 

{
   "label": "testapp",
   "name": "testapp",
   "package": "testapp.tar.gz",
   "status": "installed",
   "version": ""
}


PATCH

Upgrade a Splunkbase app.


Request parameters

stack String The URL prefix of the Splunk Cloud Platform deployment.
splunkbaseID Number The Splunkbase app ID number. You can find the splunkbaseID value in the URL of the Splunkbase app download page.

Returned values

Name Type Description
label String The app label.
name String The app name.
status String The app installation status.
version Number The app version.
appID String The app name. Same as name and app_name parameters.
splunkbaseID String The Splunkbase app ID number.

Example request and response

JSON Request 

curl -X PATCH 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/SplunkforPaloAltoNetworks' \
--header X-Splunkbase-Authorization: bgf4ztyxcgssgcbdrhguzl0xgousxzcq' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'ACS-Licensing-Ack: http://opensource.org/licenses/ISC' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-urlencode 'splunkbaseID=491'

JSON Response 

{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.3"
}

DELETE

Uninstall an app.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
app_name String The name of the app.


Returned values
None


Example request and response

JSON Request 

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…'

JSON Response 

{
"code": "200"
}

Manage restarts

restart-now

https://admin.splunk.com/{stack}/adminconfig/v2/restart-now

Initiate a restart of the search head tier in Splunk Cloud Platform.

POST

Initiate a restart of a single search head or a rolling restart of a search head cluster.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

None

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/restart-now' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...'

JSON Response 

{
    "message": "Successfully initiated a server restart. It might take some time for completion"
}

restart/status

https://admin.splunk.com/{stack}/adminconfig/v2/restart/status

Check status of search head cluster rolling restart.

The restart/status endpoint applies to search head cluster rolling restarts only. The endpoint does not work with non-clustered search heads.


GET

Check status of search head cluster rolling restart.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
rollingRestartInitiated Boolean A value of "true" means a rolling restart is in progress.
serviceReady Boolean A value of "true" means all cluster members have Successfully resatarted.
captain String URL prefix of the current search head cluster captain.

Example request and response

JSON Request 

curl https://admin.splunk.com/{stack}/adminconfig/v2/restart/status \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...

JSON Response 

{
    "shcStatus": [
{
	   "captain": "sh-i-..",
        "rollingRestartInitiated": true,
        "serviceReady": false
     }
   ]

Retry failed operations

deployment/status

https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status

Check the status of the latest operation in Splunk Cloud Platform.


GET

Check the status of the latest operation in Splunk Cloud Platform


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
id String The latest deployment ID on the stack.
timestamp String The time at which the latest operation was initiated.
status String The status of the latest operation.

Example request and response

JSON Request 

curl https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...

JSON Response 

{
   "lastDeployment": {
       "id": "AD11DDF4-B13B-4EDC-9B4F-A5FF539CD196",
       "timestamp": "6/16/2023, 11:31:22 AM",
       "status": "failed"
   }
}

deployment/retry

https://admin.splunk.com/{stack}/adminconfig/v2/deployment/retry

Retry a failed operation in Splunk Cloud Platform.

ACS supports retry for private app installation and HEC token management operations only

POST

Retry a failed private app installation or HEC token management operation.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.


Returned values

Name Type Description
id String The new deployment ID of the retried operation.
timestamp String The time at which the retry operation was initiated.
status String The status of the retry operation.

Example request and response

JSON Request 

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/deployment/retry' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1...'

JSON Response 

{
   "id": "30D3BC03-11AC-4A16-88F7-7924735638ED",
   "timestamp": "6/16/2023, 11:31:22 AM",
   "status": "new"
}

deployment/status/{deploymentID}

https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status/{deploymentID}

Check the status of an operation in Splunk Cloud Platform.


GET

Check the status of a retry or other operation by deployment ID in Splunk Cloud Platform.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
deploymentID String The deployment ID of the operation for which you want to check status.


Returned values

Name Type Description
id String The deployment ID specified in the request.
timestamp String The time at which the operation specified by the deployment ID was initiated.
status String The status of of the operation specified by deployment ID.

Example request and response

JSON Request 

curl https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status/{deploymentID} \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...

JSON Response 

{
   "lastDeployment": {
       "id": "AD11DDF4-B13B-4EDC-9B4F-A5FF539CD196",
       "timestamp": "6/16/2023, 11:31:22 AM",
       "status": "running"
   }
}

View maintenance windows

maintenance-windows/schedules

https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules

List maintenance windows.


GET

List multiple scheduled maintenance windows.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
fromTime String The earliest time the maintenance window schedule starts. Acceptable format is YYYY-MM-DD or in RFC3339 (YYYY-MM--DDTHH:mm:SSZHH:mm)
toTime String The latest time the maintenance window schedule starts. Acceptable format is YYYY-MM-DD or in RFC3339 (YYYY-MM--DDTHH:mm:SSZHH:mm).
count Number The number of maintenance windows to list.
nextLink String Start time of the next scheduled maintenance window relative to the maintenance window count. A value of null indicates there are no more maintenance windows. UTC is the default timezone.


Returned values

Name Type Description
duration String Scheduled length of time for the maintenance window.
lastModifiedTimestamp String The time of the last update to a maintenance window information response field (for example, change of status, change of description, and so on).
mwType String The maintenance window type (purpose). It can have one of the following values:

1. Service update
2. Routine Maintenance
3. Emergency Maintenance
4. Customer Initiated Change

operationType String Type of operation/upgrade performed as part of this maintenance.
operationStatus String Current status of the operation.
startTime String The start time of the operation.
endTime String The end time of the operation.
scheduleId String The scheduled maintenance window ID.
scheduleStartTimestamp String Maintenance window start time.
status String Maintenance window status.
nextLink String Start time of the next scheduled maintenance window relative to the maintenance window count. A value of null indicates there are no more maintenance windows. UTC is the default timezone.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules?fromTime=2022-08-09&toTime=2022-08-14&nextLink=2022-08-21T04:00:00Z&count=1' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsu …'

JSON Response 

{
   "nextLink": "2022-08-21T04:00:00Z",
   "schedules": [
       {
           "duration": "2h",
           "lastModifiedTimestamp": "2022-11-16T19:09:53Z",
           "lastSummary": "Customer requested upgrade",
           "mwType": "Service Update",
           "operations": [
               {
                   "SFDCTickets": [
                       "string"
                   ],
                   "endTime": "2022-04-20T05:00:00Z",
                   "notes": [
                       "string"
                   ],
                   "operationDescription": "string",
                   "operationStatus": "Tentative",
                   "operationType": "Splunk Upgrade",
                  "startTime": "2022-09-20T04:00:00Z",
                   "targetVersion": "string"
               }
           ],
           "requestedEntity": "splunk",
           "scheduleId": "1e4729b4-11d0-4165-a886-a21cce7139f2",
           "scheduleStartTimestamp": "2022-08-21T04:00:00Z",
           "status": "Tentative"
       }
   ]
}

maintenance-windows/schedules/{scheduleId}

https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}

Describe individual maintenance windows.


GET

Describe a specific scheduled maintenance window.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
scheduleId String The scheduled maintenance window ID.


Returned values

Name Type Description
duration String Scheduled length of time for the maintenance window.
lastModifiedTimestamp String The time of the last update to a maintenance window information response field (for example, change of status, change of description, and so on).
mwType String The maintenance window type (purpose). It can have one of the following values:

1. Service update
2. Routine Maintenance
3. Emergency Maintenance
4. Customer Initiated Change

operationType String Type of operation/upgrade performed as part of this maintenance.
operationStatus String Current status of the operation.
startTime String The start time of the operation.
endTime String The end time of the operation.
scheduleId String The scheduled maintenance window ID.
scheduleStartTimestamp String Maintenance window start time.
status String Maintenance window status.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsu …'

JSON Response 

{
   "duration": "2h",
   "lastModifiedTimestamp": "2022-11-16T19:09:53Z",
   "lastSummary": "Customer requested upgrade",
   "mwType": "Service Update",
   "operations": [
       {
           "SFDCTickets": [
               "string"
           ],
           "endTime": "2022-04-20T05:00:00Z",
           "notes": [
               "string"
           ],
           "operationDescription": "string",
           "operationStatus": "Tentative",
           "operationType": "Splunk Upgrade",
           "startTime": "2022-04-20T04:00:00Z",
           "targetVersion": "string"
       }
   ],
   "requestedEntity": "splunk",
   "scheduleId": "14479cd5-8ada-41f0-92c4-d234e9124569",
   "scheduleStartTimestamp": "2022-08-13T04:00:00Z",
   "status": "Tentative"
}

maintenance-windows/schedules/{scheduleId}/audits

https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}/audits

Audit maintenance windows.


GET

View audit trail of a specified maintenance window.


Request parameters

Name Type Description
stack String The URL prefix of the Splunk Cloud Platform deployment.
scheduleId String The scheduled maintenance window ID.
fromTime String The earliest time the maintenance window schedule starts. Acceptable format is YYYY-MM-DD or in RFC3339 (YYYY-MM--DDTHH:mm:SSZHH:mm)
toTime String The latest time the maintenance window schedule starts. Acceptable format is YYYY-MM-DD or in RFC3339 (YYYY-MM--DDTHH:mm:SSZHH:mm).


Returned values

Name Type Description
duration String Scheduled length of time for the maintenance window.
lastModifiedTimestamp String The time of the last update to a maintenance window information response field (for example, change of status, change of description, and so on).
mwType String The maintenance window type (purpose). It can have one of the following values:

1. Service update
2. Routine Maintenance
3. Emergency Maintenance
4. Customer Initiated Change

operationType String Type of operation/upgrade performed as part of this maintenance.
operationStatus String Current status of the operation.
startTime String The start time of the operation.
endTime String The end time of the operation.
scheduleId String The scheduled maintenance window ID.
scheduleStartTimestamp String Maintenance window start time.
status String Maintenance window status.

Example request and response

JSON Request 

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}/audits?fromTime=2022-08-09&toTime=2022-08-14' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsu …'

JSON Response 

{
   "audits": [
       {
           "duration": "2h0m0s",
           "lastModifiedTimestamp": "2022-11-01T18:09:25Z",
           "lastSummary": "",
           "mwType": "Service Update",
           "operations": [
               {
                   "operationDescription": "Splunk version upgrade to latest/stable release",
                   "operationStatus": "Completed",
                   "operationType": "SplunkUpgrade",
                   "targetVersion": "9.0.2209.1"
               }
           ],
           "requestedEntity": "Splunk",
           "scheduleId": "66e20f3f-aea2-4096-982f-7f93a6979872",
           "scheduleStartTimestamp": "2022-10-14T04:00:00Z",
           "status": "Completed"
       },
       {
           "duration": "2h0m0s",
           "lastModifiedTimestamp": "2022-10-11T18:09:25Z",
           "lastSummary": "",
           "mwType": "Service Update",
           "operations": [
               {
                   "operationDescription": "Splunk version upgrade to latest/stable release",
                   "operationStatus": "Completed",
                   "operationType": "SplunkUpgrade",
                   "targetVersion": "9.0.2209.1"
               }
           ],
           "requestedEntity": "Splunk",
           "scheduleId": "66e20f3f-aea2-4096-982f-7f93a6979872",
           "scheduleStartTimestamp": "2022-10-14T04:00:00Z",
           "status": "Completed"
       }
   ]
}
Last modified on 10 October, 2023
PREVIOUS
View maintenance windows for Splunk Cloud Platform 		  NEXT
Administer Splunk Cloud Platform using the ACS CLI

This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305 (latest FedRAMP release), 9.1.2308

Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters