topic Re: Can we use "| rest" to call Splunk instances other than local? in Getting Data In

Can we use "| rest" to call Splunk instances other than local?

philip_wong — Mon, 28 Sep 2020 17:12:45 GMT

So far, I'm only able to run these against local Splunk.
It has nothing returned when I replaced "local" with other hostname.
Is it possible to run these against remote Splunk and forwarder?
Any requirement to make this work? I've already set allowRemoteLogin = always

| rest /services/data/indexes count=0 splunk_server=local
| rest /services/admin/inputstatus/TailingProcessor:FileStatus timeout=300 splunk_server=local

Also, what if management port is something else than 8089, e.g. 9001?

Re: Can we use "| rest" to call Splunk instances other than local?

somesoni2 — Wed, 30 Jul 2014 15:02:40 GMT

I believe it works only for the Current Splunk instance (e.g. Search head where query is running) and it's search peers (e.g. indexers). Run this and see what all splunk_server values it can support.

|rest /services/data/indexes count=0 splunk_server=*| stats count by splunk_server

Only the server name listed here will work as argument

Re: Can we use "| rest" to call Splunk instances other than local?

meleperuma — Fri, 31 May 2019 03:42:33 GMT

Yes you can. But you need to make sure the other instance that you are trying to run it against is a Search Peer to the instance you are executing from. That means you cant run it for a remote Forwarder.

you can run it against any hostname you get from below search:

|rest /services/data/indexes count=0 splunk_server=*
| stats count by splunk_server

Example:

|rest /services/data/indexes count=0 splunk_server=*| stats count by splunk_server

| rest splunk_server=splunk05 /servicesNS/-/-/configs/conf-props search="eai:acl.app=search"
| search title=*
| rename eai:acl.app as app, eai:acl.perms.read as read, eai:acl.sharing as sharing
| fields - updated published id eai*
| fields title author splunk_server app read sharing *
| eval title="[".title."]"
| foreach * [eval title=if("<>"="author" OR "<>"="splunk_server" OR "<>"="app" OR "<>"="read"  OR "<>"="sharing" OR "<>"="title" OR '<>'="",title,mvappend(title,"<>"."="."\"".'<>'."\""))]
| fields title author splunk_server app read sharing