topic Re: Is there a REST API to remove missing forwarders? in Getting Data In

Is there a REST API to remove missing forwarders?

gthiers — Wed, 29 Mar 2017 19:18:35 GMT

I have already found documentation on updating the "DMC Forwarder - Build Asset Table" with a post as referenced here:

https://answers.splunk.com/answers/426211/is-there-a-rest-api-call-to-rebuild-the-forwarder.html

This does not actually achieve what I wish to do. We wish to automate via an API call how one rebuilds forwarder assets in Splunk. This is done in Splunk Web in the Distributed Management Console (DMC)->settings->Forwarder Monitoring Setup and then I can set the data collection interval and hit the button "Rebuild Forwarder Assets". I want an API call to do that. Is this possible?

Re: Is there a REST API to remove missing forwarders?

ppeterson — Wed, 29 Mar 2017 21:18:31 GMT

https://host:8089/services/deployment/server/clients?count=0 to pull the full Universal Forwarder list.

https://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTdeploy

deployment/server/clients/{name}

https://:/services/deployment/server/clients/{name}

Get client information or remove a client.

DELETE

Remove the specified client from the deployment server registry. The next time the client "phones home" the record is re-created.

Re: Is there a REST API to remove missing forwarders?

gthiers — Thu, 30 Mar 2017 19:12:14 GMT

Thanks! @ppeterson

Re: Is there a REST API to remove missing forwarders?

gthiers — Fri, 31 Mar 2017 15:34:45 GMT

Hi @ppeterson. After looking more into this, it turns out we don't have our deployment server set up because we use a 3rd party tool to set up splunk instances. Is there any other API call that can remove missing forwarders outside of the deployment server route? Or is there a macro that can be utilized?