debug refresh or _bump using REST API

[ramesh_babu71]

Hello,

Is there any way to use debug/refresh or _bump Splunk using API. I have tried the https://apps.splunk.com/app/1871/ app/code but it doesn't seem to be working on Splunk 7.0. I have kept a file in appserver/static folder which gets changed occasionally but Splunk always sends the cached old version until we refresh/_bump/restart.

I have tried running the following rest API without success

https://splunk3:8089/servicesNS/nobody/search/admin/myapp/_reload

I am also open to using python request.post to send the refresh command. But it asks for username/passsword which I don't want users to provide app/script.

http://splunk3:8000/debug/refresh -d splunk_form_key=5401708645855026883

Do we have any option to send this command with a sessionkey instead of credentials like in REST API ?

[MuS · Accepted solution]

Hi ramesh_babu71,

creator of the mentioned app here, there will be soon an update to the app released which works on Splunk 7.1.x. It also features the option to only reload one specific entity.

Link to the app: https://splunkbase.splunk.com/app/1871/#/details

cheers, MuS

[ramesh_babu71]

Thanks Michael for the update.

I do see an entry in the add-on download page
18. August 2018 : 2.3.0 - added entity option
but new version is not available for download yet. Can you share a tentative date on when the new version will be available for download ?

Regards,
Ramesh

[MuS]

Nope, since this has to go through the app certification process and this can take time ...

cheers, MuS

[MuS]

Update now available here https://splunkbase.splunk.com/app/1871/

cheers, MuS

[seegeekrun]

What I use to refresh or reload an app is a python script on the command line. It could obviously be tweaked to be automated using stored credentials, but for my purposes, I only use when developing to update when I make changes.

Here's the script in it's entirety:
import sys
import splunklib.client as client
import getpass

splunkServer = raw_input('Enter the splunk server: ')
splunkAdmin = raw_input('Enter Splunk Admin: ')
splunkPassword = getpass.getpass('Enter Splunk Password: ')
splunkDestApp = raw_input('Enter target App Context: ')
if splunkDestApp:
    splunkService = client.connect(host=splunkServer, port=8089, username=splunkAdmin, password=splunkPassword, app=splunkDestApp)
else:
    splunkService = client.connect(host=splunkServer, port=8089, username=splunkAdmin, password=splunkPassword)

print('Refreshing app entity...')

applications = splunkService.apps

for app in applications:
    if splunkDestApp:
        if app.name == splunkDestApp:
            try:
                #app.refresh()
                app.reload()
                print(splunkDestApp+' has been refreshed')
            except  EntityDeletedException:
                print('Application '+splunkDestApp+' does not exist.')

The gist is, it prompts for the server and credentials and then which app is to be reloaded. I run it using:
>splunk cmd python scriptname.py

[pongc]

Try this endpoint: http://docs.splunk.com/Documentation/Splunk/7.0.2/RESTREF/RESTsystem#server.2Fcontrol.2Frestart_webu...

using the code from the above TA

>>> target="server/control/restart_webui"
>>> response, content = rest.simpleRequest(target, sessionKey=sessionKey, method='POST')
>>> response
{'expires': 'Thu, 26 Oct 1978 00:00:00 GMT', 'date': 'Wed, 07 Feb 2018 03:51:03 GMT', 'cache-control': 'no-store, no-cache, must-revalidate, max-age=0', 'content-type': 'text/xml; charset=UTF-8', 'x-frame-options': 'SAMEORIGIN', 'server': 'Splunkd', 'status': '200', 'x-content-type-options': 'nosniff', 'content-length': '2174', 'connection': 'Close', 'vary': 'Authorization'}

This does achieve the desired result of refreshing static content, though it does restart the UI which will impact users.