https://community.splunk.com/t5/Deployment-Architecture/How-to-access-a-REST-endpoint-on-the-deployment-server-from-a/m-p/272376#M10361 <P>The <CODE>| rest</CODE> command only works for local server (current search head) and all search peers (Indexer/Peers that have been setup in distributed search). So to access deployment server Rest Api endpoints, add your deployment server as the search peer (Settings-&gt;Distributed search-&gt; Search peers)</P> Tue, 13 Dec 2016 20:07:37 GMT somesoni2 2016-12-13T20:07:37Z https://community.splunk.com/t5/Deployment-Architecture/How-to-access-a-REST-endpoint-on-the-deployment-server-from-a/m-p/272375#M10360 <P>I'm trying to populate a lookup table with information about my deployment clients. The only place I've found to get that information is from the deployment server itself. The following rest command returns the data I want, but it only works when I run it on the deployment server (which is not a search head peer, so doesn't have access to the same lookup tables for <CODE>|outputlookup</CODE>).</P> <P>If I specify "splunk_server=master" in the search, and run it on my normal search head cluster, I get no results back.</P> <P>Is there a way to make the search run on my normal search heads and query against the deployment server? Or, alternatively, run on the master and write against a lookup table (kvstore, if it matters) on my search head cluster?</P> <PRE><CODE>| rest splunk_server=local /services/deployment/server/clients |eval serverClass="" |foreach *.serverclasses [eval serverClass=mvdedup(mvappend(serverClass,'&lt; &lt; FIELD &gt; &gt;'))] |rename hostname as sourceHost ip as sourceIp |table sourceHost,sourceIp,serverClass </CODE></PRE> Tue, 13 Dec 2016 18:43:25 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-access-a-REST-endpoint-on-the-deployment-server-from-a/m-p/272375#M10360 azollmanflatiro 2016-12-13T18:43:25Z https://community.splunk.com/t5/Deployment-Architecture/How-to-access-a-REST-endpoint-on-the-deployment-server-from-a/m-p/272376#M10361 <P>The <CODE>| rest</CODE> command only works for local server (current search head) and all search peers (Indexer/Peers that have been setup in distributed search). So to access deployment server Rest Api endpoints, add your deployment server as the search peer (Settings-&gt;Distributed search-&gt; Search peers)</P> Tue, 13 Dec 2016 20:07:37 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-access-a-REST-endpoint-on-the-deployment-server-from-a/m-p/272376#M10361 somesoni2 2016-12-13T20:07:37Z