Deployment Architecture

Using Splunk API to remove agents from deployment server

cameronr0705
New Member

We have an asset database that keeps track of decommissioned assets. We can make a table of all decommissioned assets in our environment. Is there a way to use the REST API to remove those assets from the deployment server.

Something like:
"Status="end of life"| foreach AssetName rest DELETE https://localhost:8089/services/deployment/server/clients/AssetName"

0 Karma

gjanders
SplunkTrust
SplunkTrust

You could install an app like https://splunkbase.splunk.com/app/4146/ and use the | curl method=delete option, it will involve a few tricks and most likely you would want a | map to run the curl command many times.

You might need to apply this fix if installing version 1.2.3 for the TA webtools.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You have the right idea, but POST and DELETE operations cannot be performed from a search. You'll have to write a script that reads your list of decommissioned assets and sends the REST commands to Splunk using curl or similar.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...