topic Re: How do I use the REST API? in Getting Data In

How do I use the REST API?

sdorich — Wed, 12 Feb 2014 14:48:59 GMT

I've been trying to follow the instructions on the following site:

http://dev.splunk.com/view/SP-CAAADQT

However, I keep getting the issue that the page cannot be found (I'll paste the exact output I get from the following call at the bottom). I might be missing a step so please let me know if there's something else I need to do first. Thanks in advance.

This call (note that I do not use https b/c the secure connection was not found at all)

curl -u admin: -k http://localhost:8000/serviceNS/admin/search

outputs

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

The path '/en-US/serviceNS/admin/search/auth/login/' was not found. - Splunk

Re: How do I use the REST API?

sdorich — Wed, 12 Feb 2014 14:50:16 GMT

Note that I'm a newbie to REST API calls so bare with me. Thanks!

Re: How do I use the REST API?

sowings — Wed, 12 Feb 2014 15:17:11 GMT

You'll have to talk to Splunk's management port (default 8089), not the Splunkweb port (default 8000). It also speaks https.

Also, the URL you tried "/servicesNS/admin/search" is incomplete. That just says "for the admin user in the search app context...". An example might be: https://127.0.0.1:8089/servicesNS/admin/search/saved/searches" to list the saved searches visible to the admin user in the search app. Some good examples are found here (Splunk docs) as well.

Re: How do I use the REST API?

Ayn — Wed, 12 Feb 2014 15:17:24 GMT

You're using the wrong port. Port 8000 is Splunk's regular web interface. The REST API is available on port 8089 (over HTTPS).

Re: How do I use the REST API?

sdorich — Wed, 12 Feb 2014 16:25:13 GMT

@sowings -
Thanks, that helps. One last question (remember I'm a newbie with the REST API).. I'm assuming that I don't need to set up a forwarder on the server I want to get REST API calls from since these calls use http methods. Am I correct or is a forwarder still needed for whatever reason?

Re: How do I use the REST API?

sowings — Wed, 12 Feb 2014 18:05:34 GMT

The REST API is for talking to the management port of "a" Splunk instance. You can talk REST to a forwarder, but it won't have a lot to say. You don't need the forwarder to query the server (indexer).