topic Re: How to Access Splunk's REST API in Getting Data In

How to Access Splunk's REST API

_gkollias — Tue, 16 Jun 2015 17:46:33 GMT

I'm working on sending requests to Splunk's REST API for the first time and have a few questions after reading through the tutorial/manual:

I can't locate the /services/ directory under /splunk/home/. Is this created out of the box, or something we need to add in /etc/apps?
Our dev environment is currently http - will sending requests to http://localhost:8080/... be sufficient for testing?

Any insight is greatly appreciated.

Thanks!

Re: How to Access Splunk's REST API

richgalloway — Tue, 16 Jun 2015 18:08:38 GMT

You don't need to create anything for the REST API to work.
That should work just fine.

Re: How to Access Splunk's REST API

_gkollias — Tue, 16 Jun 2015 19:03:21 GMT

Awesome - maybe I'm over-thinking this one. So it's really as simple as if there is no /services/ directory just point it to wherever the saved search is IE http://localhost:8080/en-US/apps/search/saved/searches?

Re: How to Access Splunk's REST API

richgalloway — Tue, 16 Jun 2015 19:06:48 GMT

You're still over-thinking it. 🙂 There is no services directory, but you must still include it in your query. Follow the manual and you should do fine.

Re: How to Access Splunk's REST API

Damien_Dallimor — Wed, 17 Jun 2015 21:07:50 GMT

There are numerous examples (using CURL) of using the Splunk REST API in the reference manual.

Via your browser you could also browse to https://localhost:8089/services

Furthermore , we have many language SDK's that make it easier to programmatically interact with the Splunk REST API.

Re: How to Access Splunk's REST API

_gkollias — Fri, 19 Jun 2015 12:26:46 GMT

Thanks, Damien

Again the example you've posted goes back to using https with port 8089. Our dev environment is currently http - would that make a difference? Here is what I see when I use http://localhost:8080

The path '/en-US/services' was not found.

What should I see here?

Re: How to Access Splunk's REST API

Damien_Dallimor — Fri, 19 Jun 2015 12:35:25 GMT

8089 is splunk's default management port and the port you access the Rest Api at over https.

Perhaps you are confusing yourself with the Splunk Web port which is by default 8000 and accessed over http.This is not Splunk's Rest Api endpoint.

Please follow and try the advice in my prior post.