topic Re: Setting up the ACS API for accessing the Splunk Cloud REST API in Splunk Cloud Platform

Setting up the ACS API for accessing the Splunk Cloud REST API?

tomapatan — Tue, 04 Apr 2023 16:41:57 GMT

I`m trying to query Splunk Cloud using the REST API so that I can export some data externally, however I`m not entirely sure how to download/install/configure the ACS Open API 3.0 specification. The Splunk documentation is a bit ambiguous.

I`m also unable to setup a new authentication token, receiving the error below. I`m using an admin account.

curl -u username:password -X POST https://admin.splunk.com/[myValidStackName]/adminconfig/v2/tokens

{"code":"401-unauthorized","message":"{\"messages\":[{\"type\":\"ERROR\",\"text\":\"Unauthorized\"}]}. Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips."}

Re: Setting up the ACS API for accessing the Splunk Cloud REST API

richgalloway — Mon, 03 Apr 2023 13:51:08 GMT

As the name implies, Admin Config Service (ACS) is for making administrative configuration changes to a Splunk Cloud stack. It does not provide a means for exporting data.

The 401 error means the credentials supplied with the ACS request are incorrect.

Re: Setting up the ACS API for accessing the Splunk Cloud REST API

tomapatan — Mon, 03 Apr 2023 20:50:06 GMT

Thanks for the reply.

I`ve managed to create the token using a native user account and I can successfully query the Admin Config Services API, but I`m having issues getting data from the REST API, receiving a timed out message.

curl https://[myValidStackName].splunkcloud.com:8089/services/saved/searches/

Am I using the correct endpoint ?

Also, can the REST API be queried using the token, or do I have to provide credentials ?

Many thanks.

Re: Setting up the ACS API for accessing the Splunk Cloud REST API

richgalloway — Mon, 03 Apr 2023 21:13:52 GMT

Use the search/v2/jobs/export endpoint to fetch results.

Yes, you should be able to use tokens to authenticate a REST API call. See https://docs.splunk.com/Documentation/Splunk/9.0.4/RESTUM/RESTusing#Authentication_and_authorization

Re: Setting up the ACS API for accessing the Splunk Cloud REST API?

rishav-ukg — Sat, 07 Dec 2024 16:31:44 GMT

Hi @tomapatan,

I need to call Splunk Cloud REST API endpoints from java service to get back the results of a search query.

Could you please provide the curl to create authentication token and any one REST API endpoint using that token to get data.

Re: Setting up the ACS API for accessing the Splunk Cloud REST API?

richgalloway — Sat, 07 Dec 2024 22:41:25 GMT

This thread is resolved. For betters chances of a reply, please post a new question.