Deployment Architecture

What is the curl command used on the deployer to apply shcluster-bundle?

tsunamii
Path Finder

Looking for a REST equivalent of this apply shcluster-bundle -target command:

./splunk apply shcluster-bundle -target https://xx.xx.x.xxx:8089 -auth admin:changeme --no-prompt --answer-yes 

I want to get the session so I do not have to have hard coded credentials, and I want it in the form of a curl command.

1 Solution

jreuter_splunk
Splunk Employee
Splunk Employee

This appears to work, and is what the cli uses (from testing with 6.2.5, your mileage may vary):

curl -u <user>[:password] https://<splunkd>:<splunkd_port>/services/apps/deploy -d 'target=https://<target>&action=all&advertising=true' -X POST

Replace the values as appropriate:

Replace <user> with your user
[:password] is optional - the user's password
<splunkd> is the host or IP of the deployer
<target> in the POST data is the equivalent of the value of the -target argument for the cli.

View solution in original post

jreuter_splunk
Splunk Employee
Splunk Employee

This appears to work, and is what the cli uses (from testing with 6.2.5, your mileage may vary):

curl -u <user>[:password] https://<splunkd>:<splunkd_port>/services/apps/deploy -d 'target=https://<target>&action=all&advertising=true' -X POST

Replace the values as appropriate:

Replace <user> with your user
[:password] is optional - the user's password
<splunkd> is the host or IP of the deployer
<target> in the POST data is the equivalent of the value of the -target argument for the cli.

ejwade
Contributor

Hi @jreuter_splunk.

Including @xpac@Kyle_Jackson, @ben_leung, @tsteens@muebel@gjanders as well, since they were active on the "Is there a REST API call to apply shcluster-bundle with the deployer?" post as well.

This solution is fairly old (neary 10 years). Now that we're in 9.x, is there another way to do this? I still wasn't able to find it in the REST API Reference Manual.

0 Karma

tsunamii
Path Finder

Thanks @jreuter. Seems to be working on my 6.2.5 SHC:

root@sup-ubuntu1-cu:~/splunk62$ curl -ku admin https://localhost:8089/services/apps/deploy -d 'target=https://sup-centos1-cu:8089&action=all&advertising=true' -X POST
Enter host password for user 'admin':
["https://xx.xx.x.xxx:8089","https://xx.xx.x.xxx:8089","https://xx.xx.x.xxx:8089"]root@sup-ubuntu1-cu:~/splunk62$
0 Karma

ben_leung
Builder

Confirmed in 6.3.1 working too. Thank you sir

-bash-3.2$  curl -k -u bleung https://localhost:8089/services/apps/deploy -d 'target=https://host_name3.domain.com:8089&action=all&advertising=true' -X POST
Enter host password for user 'bleung':
[{"target_uri":"https://xx.xxx.xx.xx:8089","target_label":"host_name1.domain.com"},{"target_uri":"https://xx.xxx.xx.xx:8089","target_label":"host_name2.domain.com"},{"target_uri":"https://xx.xxx.xx.xx:8089","target_label":"host_name3.domain.com"},{"target_uri":"https://xx.xxx.xx.xx:8089","target_label":"host_name4.domain.com"}]-bash-3.2$ echo $?
0
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...