All Apps and Add-ons
Highlighted

Splunk Cloud configs API endpoint using '| rest'

Communicator

Hello there,

I am trying to understand how to work with | rest queries on Splunk Cloud.

For instance, using Enterprise version I am able to pull this endpoint to retrieve authorize configuration info:

| rest /servicesNS/-/-/configs/conf-authorize

This does not exist in Splunk Cloud.

Doc says it would be

/services/configs/conf-authorize

but it does not work, using '| rest' at least.

Is there a way to access configs endpoint using a '| rest' query on Splunk Cloud?

Thanks in advance for any hint!

0 Karma
Highlighted

Re: Splunk Cloud configs API endpoint using '| rest'

SplunkTrust
SplunkTrust

Hi @D2SI,

Did you have a look here :
https://answers.splunk.com/answers/470291/is-using-rest-api-not-allowed-with-splunk-cloud-tr.html

rest works exactly the same for Splunk Cloud and Enterprise. But cant be used in trial mode with Splunk Cloud.

Cheers,
David

View solution in original post

Highlighted

Re: Splunk Cloud configs API endpoint using '| rest'

Communicator

Wow, I did not think of that!

Thanks

0 Karma
Highlighted

Re: Splunk Cloud configs API endpoint using '| rest'

SplunkTrust
SplunkTrust

You're welcome 🙂

0 Karma