Developing for Splunk Enterprise

Restart Splunk Inputs through API Call



I am having an issue that the Microsoft 0365 Reporting Add-On continues to stop working. We found that usually a restart of the input in the WebUI fixes the issue. Now I was wondering if it possible to restart those inputs through an API call.

I found the command that Splunk performs when you disable the Inputs in the Add-On to be from tine internal logs:



admin [22/Jul/2020:09:49:19.674 -0400] "POST /servicesNS/nobody/TA-MS_O365_Reporting/data/inputs/ms_o365_message_trace/ms_o365_message_trace/disable HTTP/1.1"



I have tried in powershell different variations of this command below but didn't have any luck so far. Is possible to call these WebUI commands through an API command ?



Invoke-Restmethod -Uri  http://localhost:8088/servicesNS/nobody/TA-MS_O365_Reporting/data/inputs/ms_o365_message_trace/ms_o365_message_trace/disable -Method POST

Invoke-Restmethod : {"text":"The requested URL was not found on this server.","code":404}
At line:1 char:1
+ Invoke-Restmethod -Uri  http://localhost:8088/servicesNS/nobody/TA-MS ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Thank you,


Labels (3)
0 Karma