Splunk Cloud configs API endpoint using '| rest'

[D2SI]

Hello there,

I am trying to understand how to work with | rest queries on Splunk Cloud.

For instance, using Enterprise version I am able to pull this endpoint to retrieve authorize configuration info:

| rest /servicesNS/-/-/configs/conf-authorize

This does not exist in Splunk Cloud.

Doc says it would be

/services/configs/conf-authorize

but it does not work, using '| rest' at least.

Is there a way to access configs endpoint using a '| rest' query on Splunk Cloud?

Thanks in advance for any hint!

[DavidHourani · Accepted solution]

Hi @D2SI,

Did you have a look here :
https://answers.splunk.com/answers/470291/is-using-rest-api-not-allowed-with-splunk-cloud-tr.html

rest works exactly the same for Splunk Cloud and Enterprise. But cant be used in trial mode with Splunk Cloud.

Cheers,
David

[D2SI]

Wow, I did not think of that!

Thanks

[DavidHourani]

You're welcome 🙂