topic Setting tag values through REST API in Getting Data In

Setting tag values through REST API

spbayer — Tue, 29 Mar 2011 02:40:04 GMT

Is it possible create tags and set tag values through the REST API?

Re: Setting tag values through REST API

gkanapathy — Tue, 29 Mar 2011 07:13:58 GMT

It is theoretically possible. In general, anything you can do via the UI can be done via the REST API, since the UI uses the REST API to do all Splunk server and object manipulations. However, in practice, not all object manipulations are currently published.

Re: Setting tag values through REST API

Ledion_Bitincka — Tue, 29 Mar 2011 08:08:12 GMT

Yes it is possible, this not publicly documented however this is how the UI adds/deletes fields from the search view

POST /servicesNS/<user>/<app>/search/fields/<field-name>/tags "value=ValueToTagHere&add=tag1&add=tag2&delete=tag3&delete=tag4"

You can have as many add and delete tags as you wish in your POST

Re: Setting tag values through REST API

ma_anand1984 — Fri, 01 Mar 2013 11:14:55 GMT

@Ledion Bitincka
I dont understand, we usually access tags like | rest splunk_server=local /servicesNS/-/-/search/fields/{field name}/tags

how to user POST is it like "| POST "or "| rest POST". Can you give full command?

Re: Setting tag values through REST API

asdfasdf12321 — Tue, 17 Mar 2015 16:38:07 GMT

The tagger app appears to use this undocumented API.

Re: Setting tag values through REST API

asdfasdf12321 — Thu, 19 Mar 2015 17:17:52 GMT

It's also possible to remove tags more globally with something like:

curl -u admin:changeme -k https://localhost:8089/servicesNS/admin/<app>/search/tags/<tag-name>; -d "delete"

Or the curl equivient of the above answer is:

curl -u admin:changeme -k https://localhost:8089/servicesNS/admin/<app>/search/fields/<field-name>/tags  -d"value=ValueToTagHere&add=tag1&add=tag2&delete=tag3&delete=tag4"