topic Re: Is there a REST call to create an index dynamically? in Getting Data In

Is there a REST call to create an index dynamically?

a212830 — Tue, 09 Feb 2016 18:53:42 GMT

Hi,

Is there a way to automate the creation (and parameters) of new indexes through REST (hopefully pushed through the Cluster Manager)?

Re: Is there a REST call to create an index dynamically?

masonmorales — Tue, 09 Feb 2016 19:31:36 GMT

Yes, take a look at: http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTconf

Re: Is there a REST call to create an index dynamically?

Jeremiah — Tue, 09 Feb 2016 19:32:51 GMT

I haven't seen an option like that. The cluster master does have some REST endpoints for reading index data, but they are all GET methods.

http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Findexes.2F.7Bname.7D

You can individually create the index on each indexer via an API call, but that's probably risky given that the index configurations between all of servers need to match exactly. I've also had limited success creating the index on a host via API without having to restart the indexer.

You're probably stuck with managing an indexes.conf file on your cluster master and building your automation around that.

Re: Is there a REST call to create an index dynamically?

Jeremiah — Tue, 09 Feb 2016 19:55:34 GMT

This would work to create an index in a cluster? Would you have to push the change to each peer or is there an endpoint here that lets you push a change to the cluster master that is then distributed to the indexers?

Re: Is there a REST call to create an index dynamically?

masonmorales — Tue, 29 Sep 2020 08:47:08 GMT

I'm not sure if there is a way to do that directly on the master node, but you could probably use it to update the indexes.conf file on the master node (will likely be under $SPLUNK_HOME/etc/system/local/indexes.conf), then have a CRON job on the master node that periodically copies that indexes.conf file that you created through the REST API to $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf. Take a look at: http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Updatepeerconfigurations

Re: Is there a REST call to create an index dynamically?

sloshburch — Fri, 12 Feb 2016 22:38:11 GMT

I'm not sure POST is supported, but I'd guess http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Findexes for updating the master nodes index config.

If not, then maybe you can just use http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTconf to do the same for generic config updates.

Then there might be an endpoint for pushing out the updated config. Not sure if this is it: http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Fgeneration
If not, then the cron approach might work.