Can the .spec be retrieved via REST

abramble — Mon, 17 May 2021 01:56:13 GMT

Similar to fetching config by namespace via REST - Configuration Endpoints, is there a way to access the .spec defined for different config files via REST API?

Edit: spelling.

Re: Can the .spec be retrieved via REST

abramble — Wed, 09 Jun 2021 02:11:02 GMT

Answering my own question. After digging around I discovered in the default restmap.conf a reference to

[spec:spec] match=/configs/spec

What appears to be merged spec from all apps is available, however I cannot find any documentation of the input params. "filename" and "stanza" I was able to guess.

/services/config/spec?filename=alert_actions

{ "filename": "alert_actions", "stanzas": [ { "stanza": "default", "rawStanza": "default" }, { "stanza": "email", "rawStanza": "email" }, { "stanza": "logevent", "rawStanza": "logevent" }, { "stanza": "lookup", "rawStanza": "lookup" }, { "stanza": "outputtelemetry", "rawStanza": "outputtelemetry" }, { "stanza": "populate_lookup", "rawStanza": "populate_lookup" }, { "stanza": "rss", "rawStanza": "rss" }, { "stanza": "script", "rawStanza": "script" }, { "stanza": "summary_index", "rawStanza": "summary_index" }, { "stanza": "webhook", "rawStanza": "webhook" } ] }

and deeper inspection by passing the 'stanza' parameter

/services/configs/spec?filename=alert_actions&stanza=email

{ "filename": "alert_actions", "stanza": "email", "settings": [ { "name": "alert.execute.cmd", "placeholder": "<string>" }, { "name": "alert.execute.cmd.arg.<n>", "placeholder": "<string>" }, { "name": "auth_password", "placeholder": "<password>" } ] ... elided }

topic Can the .spec be retrieved via REST in Splunk Dev

Can the .spec be retrieved via REST

Re: Can the .spec be retrieved via REST