topic Re: Creation/modification of Splunk configuration objects via REST api in Splunk cloud in Splunk Enterprise

Creation/modification of Splunk configuration objects via REST api in Splunk cloud

koshyk — Thu, 15 Jul 2021 12:41:42 GMT

I've almost created a framework to update Splunk configuration items for Search Heads (transforms, props, savedsearches) etc and Create NEW apps via Splunk REST api. This works well in Standalone SH & SH cluster.

Anyone know if there are restrictions/capability restrictions kept in place for Splunk cloud offering?

ie in Cloud offering

- Can I create a new App via Rest api ?

- Can i create/modify configuration items remotely?

Re: Creation/modification of Splunk configuration objects via REST api in Splunk cloud

richgalloway — Thu, 15 Jul 2021 13:56:10 GMT

You can't create apps using the API and configuration support is limited. See https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/RESTTUT/RESTandCloud

Re: Creation/modification of Splunk configuration objects via REST api in Splunk cloud

koshyk — Fri, 16 Jul 2021 12:35:02 GMT

that's really not good.

>> is restricted from performing the following types of tasks... Installing apps and modifying app configurations

almost cancels the whole point of automation then? How do you guys control the search-time and custom TA configurations in Splunk cloud & Version control them? Manually upload them and give to Splunk support?

Re: Creation/modification of Splunk configuration objects via REST api in Splunk cloud

richgalloway — Fri, 16 Jul 2021 13:30:06 GMT

There's little need to have Splunk support do it for you. Update your apps off-line making sure you increment the version number in app.conf. Then upload the app(s) to your Splunk Cloud search head. Once they pass vetting you can install them and Splunk Cloud will deploy them to the right instance(s).