topic Using Splunk API to remove agents from deployment server in Deployment Architecture

Using Splunk API to remove agents from deployment server

cameronr0705 — Mon, 24 Jun 2019 18:42:57 GMT

We have an asset database that keeps track of decommissioned assets. We can make a table of all decommissioned assets in our environment. Is there a way to use the REST API to remove those assets from the deployment server.

Something like:
"Status="end of life"| foreach AssetName rest DELETE https://localhost:8089/services/deployment/server/clients/AssetName"

Re: Using Splunk API to remove agents from deployment server

richgalloway — Mon, 24 Jun 2019 20:56:29 GMT

You have the right idea, but POST and DELETE operations cannot be performed from a search. You'll have to write a script that reads your list of decommissioned assets and sends the REST commands to Splunk using curl or similar.

Re: Using Splunk API to remove agents from deployment server

gjanders — Thu, 27 Jun 2019 22:58:19 GMT

You could install an app like https://splunkbase.splunk.com/app/4146/ and use the | curl method=delete option, it will involve a few tricks and most likely you would want a | map to run the curl command many times.

You might need to apply this fix if installing version 1.2.3 for the TA webtools.