topic Re: How do I create an index using REST API? in Splunk Cloud Platform

How do I create an index using REST API?

Sanz — Tue, 09 Aug 2022 14:37:05 GMT

Hi All,

According to the documentation for Splunk Cloud Classic Experience

If your Splunk Cloud Platform deployment is on Classic Experience, you can manage your indexes programmatically using the Splunk REST API cluster_blaster_indexes/sh_indexes_manager endpoint.

Manage indexes on Splunk Cloud Platform Classic Experience - Splunk Documentation

When I used the command:

curl -k -H "Authorization: Bearer MyToken" https://MySplunk.splunkcloud.com:8089/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json

I get this respond:
<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta http-equiv="refresh" content="1;url=https://XX.splunkcloud.com/en-US/servicesNS/nobody/search/data/indexes"><title>303 See Other</title></head><body><h1>See Other</h1><p>The resource has moved temporarily <a href="https://XX.splunkcloud.com/en-US/servicesNS/nobody/search/data/indexes">here</a>.</p></body></html>

This brings me to a 404 page

Basically I want to create an Index using REST API on Splunk Cloud (Classic Experience)

Re: How do I create an index using REST API?

m_pham — Fri, 19 Jan 2024 15:41:08 GMT

You probably already figured it out by now but you ~~will~~ can use the ACS CLI or Terraform splunk/scp provider to manage indexes in Splunk Cloud.

Splunk ACS API REST reference:

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/Config/ACSREF#Manage_indexes

Creating a new index in Splunk Cloud example:

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/indexes' --header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' \ --header 'Content-Type: application/json' \ --data-raw '{ "name": "testindex" }'

ACS CLI:

https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSCLI

Splunk Splunk Cloud Platform Terraform provider:

https://github.com/splunk/terraform-provider-scp

Re: How do I create an index using REST API?

acharlieh — Fri, 19 Jan 2024 04:23:33 GMT

Are you certain you had the :8089 as part of your curl url? AND you used the correct url?

The redirection response you have provided is identical to the one that Splunk Web (i.e. port 443 OR no port specified with HTTPS) would give in response to a request for /servicesNS/nobody/search/data/indexes (Which would be the enterprise API url instead of the cluster blaster one you state in your post.)

Deliberately omitting the :8089 from the cluster_blaster_indexes request against my classic stack I get the following:

$ curl https://redacted.splunkcloud.com/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json <!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta http-equiv="refresh" content="1;url=https://redacted.splunkcloud.com/en-US/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json"><title>303 See Other</title></head><body><h1>See Other</h1><p>The resource has moved temporarily <a href="https://redacted.splunkcloud.com/en-US/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json">here</a>.</p></body></html>