topic Re: How to create index using REST API in a index clustered environment? in Splunk Enterprise

How to create index using REST API in a index clustered environment?

Decoder79 — Wed, 11 May 2022 00:47:04 GMT

HI All,

I have a question, How to create index using REST API in a index clustered environment?

Version : Splunk Enterprise 8.x

Re: How to create index using REST API in a index clustered environment?

isoutamo — Wed, 11 May 2022 06:31:13 GMT

based on documentation this post is still valid: https://community.splunk.com/t5/Getting-Data-In/How-to-create-index-using-REST-API-in-a-clustered-environment/td-p/269882?_ga=2.77763988.1815509022.1652032226-798791286.1633591896&_gl=1*2everd*_ga*Nzk4NzkxMjg2LjE2MzM1OTE4OTY.*_gid*MTgxNTUwOTAyMi4xNjUyMDMyMjI2&utm_campaign=no_votes_sort_relev&utm_medium=newquestion&utm_source=typeahead

You can create index on single peer, but not on cluster via rest.

You can add idea for this to ideas.splunk.com and hope that this will get enough votes to be a consider new feature.

r. Ismo

Re: How to create index using REST API in a index clustered environment?

PickleRick — Wed, 11 May 2022 07:42:17 GMT

Due to the way the cluster works I'd suppose it's not that easy and not really feasible to implement.

Since cluster configuration is maintained by confiugration bundles pushed from the master node, the REST would have to be implemented against master. And it would have to involve all that is "included" in preparing the bundle, verifying it, pushing and so on... Way too much fuss IMHO.