https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264355#M50741 <P>Not going that route seems like the right approach. There is usually a good reason that certain scenarios are not covered in the security guide <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.0/Security/Hardeningstandards">https://docs.splunk.com/Documentation/Splunk/6.5.0/Security/Hardeningstandards</A></P> Sun, 13 Nov 2016 14:36:20 GMT m_zimmermann 2016-11-13T14:36:20Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264350#M50736 <P>Hi,</P> <P>Is it possible to have a custom REST endpoint that executes scripts on a universal forwarder? </P> Wed, 25 May 2016 14:40:05 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264350#M50736 a212830 2016-05-25T14:40:05Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264351#M50737 <P>I am wondering the same. Since the handling seems to be done by $SPLUNK_HOME/bin/rest_handler.py i think it will n ot work since there is no python on a universal forwarder.<BR /> I have a script that i would like to expose as a custom rest endpoint but i get a 400/bad request as a reply.</P> Tue, 29 Sep 2020 11:44:47 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264351#M50737 dominiquevocat 2020-09-29T11:44:47Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264352#M50738 <P>If there is any, I'd be very careful about exposing it. Properly securing that endpoint would be an interesting challenge.</P> Tue, 01 Nov 2016 11:46:06 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264352#M50738 m_zimmermann 2016-11-01T11:46:06Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264353#M50739 <P>If you want to do this I would suggest using a HF and extend the Splunk Rest endpoints with restmap.conf. restmap.conf supports <STRONG>requireAuthentication</STRONG> settings.</P> Tue, 01 Nov 2016 16:31:12 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264353#M50739 bmacias84 2016-11-01T16:31:12Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264354#M50740 <P>I agree with all three comments above.</P> <P>The answer is no you can't do it on a universal forwarder, you could do it on a heavy forwarder, and be careful that you do it with security in mind. Bmacias84 gave some great info on settings you should consider if you do this with a heavy forwarder.</P> <P>What you could do is execute scripts via scripted inputs and deploy those via the deployment server.</P> Sun, 13 Nov 2016 14:10:19 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264354#M50740 jkat54 2016-11-13T14:10:19Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264355#M50741 <P>Not going that route seems like the right approach. There is usually a good reason that certain scenarios are not covered in the security guide <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.0/Security/Hardeningstandards">https://docs.splunk.com/Documentation/Splunk/6.5.0/Security/Hardeningstandards</A></P> Sun, 13 Nov 2016 14:36:20 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-have-a-custom-REST-endpoint-that-executes/m-p/264355#M50741 m_zimmermann 2016-11-13T14:36:20Z