https://community.splunk.com/t5/Knowledge-Management/How-can-I-populate-a-host-tag-from-an-external-source/m-p/246480#M2202 <P>You can edit tags through Splunk's REST API: <A href="http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#search.2Ftags">http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#search.2Ftags</A></P> <P>If you need Splunk to be the active "pulling" part, you could build a scripted or modular input that runs on a schedule, queries your external source, makes REST calls accordingly (and logs to Splunk, obviously).</P> Fri, 11 Mar 2016 22:58:43 GMT martin_mueller 2016-03-11T22:58:43Z https://community.splunk.com/t5/Knowledge-Management/How-can-I-populate-a-host-tag-from-an-external-source/m-p/246479#M2201 <P>I have a list of hosts that are assigned to a tag so the user doesn't have to input the list of hosts manually in search. These hosts are changed occasionally and I have an external system that manages those changes. Is there any way to pull the host changes from the external system (which has an api) and dynamically populate my tags instead of manually changing them.</P> Fri, 11 Mar 2016 20:01:40 GMT https://community.splunk.com/t5/Knowledge-Management/How-can-I-populate-a-host-tag-from-an-external-source/m-p/246479#M2201 jedatt01 2016-03-11T20:01:40Z https://community.splunk.com/t5/Knowledge-Management/How-can-I-populate-a-host-tag-from-an-external-source/m-p/246480#M2202 <P>You can edit tags through Splunk's REST API: <A href="http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#search.2Ftags">http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#search.2Ftags</A></P> <P>If you need Splunk to be the active "pulling" part, you could build a scripted or modular input that runs on a schedule, queries your external source, makes REST calls accordingly (and logs to Splunk, obviously).</P> Fri, 11 Mar 2016 22:58:43 GMT https://community.splunk.com/t5/Knowledge-Management/How-can-I-populate-a-host-tag-from-an-external-source/m-p/246480#M2202 martin_mueller 2016-03-11T22:58:43Z