topic Re: Can a universal forwarder be restarted via REST API? in Getting Data In

Can a universal forwarder be restarted via REST API?

xiyangyang — Fri, 22 Dec 2017 07:53:35 GMT

Can UF be restart via REST API?
What other things can be done to UF via REST API?

Re: Can a universal forwarder be restarted via REST API?

gcusello — Fri, 22 Dec 2017 07:58:14 GMT

Hi xiyangyang,
I don't know why you want to restart a UF using REST API, I think that the easiest way is a remote shell script.
Anyway you can find all the information about REST API features at http://dev.splunk.com/restapi .

Bye.

Giuseppe

Re: Can a universal forwarder be restarted via REST API?

harsmarvania57 — Fri, 22 Dec 2017 08:59:24 GMT

Hi @xiyangyang,

Yes, you can restart UF via REST API (ref doc. http://docs.splunk.com/Documentation/Splunk/7.0.1/RESTREF/RESTsystem#server.2Fcontrol.2Frestart )

curl -k -u admin:changeme https://localhost:8089/services/server/control/restart -X POST

If you want to run above command from remote server then you need to change default password for admin user otherwise you will get below error.

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="WARN">Remote login has been disabled for 'admin' with the default password. Either set the password, or override by changing the 'allowRemoteLogin' setting in your server.conf file.</msg>
  </messages>
</response>

I hope this helps.

Thanks,
Harshil