Getting Data In

Can I create a new index using the REST API?

hiddenkirby
Contributor

I am using something pretty similar to this in my transforms.conf to dynamically put events in the desired indexes.

https://answers.splunk.com/answers/150266/dynamic-index-assignment-based-on-event-or-log-prefix.html

There are situations where the index doesnt' quite exist yet. When that happens the file sink-holes into the ether, not to be ingested, nor kept in the original directory.

I'm looking to write some code to get in front of it, and

  • watch the directories
  • ensure the appropriate index exists
  • then drop the file in the Splunk-watched directory (or maybe use the api/cli to directly ingest the file in Splunk to the correct index).

This is not a clustered Splunk, though if required, it is possible. (I came across this question https://answers.splunk.com/answers/387133/how-to-create-index-using-rest-api-in-a-clustered.html?utm...)

My concern is that the solution is pointing to something like editing the indexes.conf file and rebooting splunk through the command line. Is this possible via REST API? I would also prefer not to have to reboot and kick the users off. What does the Splunk UI use to do it?

1 Solution

jkat54
SplunkTrust
SplunkTrust

You don't need to reboot splunk for index additions.

You just need to update indexes.conf and then hit the debug refresh endpoint for indexes or for everything if you prefer.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

You don't need to reboot splunk for index additions.

You just need to update indexes.conf and then hit the debug refresh endpoint for indexes or for everything if you prefer.

jkat54
SplunkTrust
SplunkTrust

hiddenkirby
Contributor

This is helpful, thank you. Is that what the UI does when you create an index?

jkat54
SplunkTrust
SplunkTrust

Yes or something very similar.

You could install something like Teleriks Fiddler on your device and see exactly what posts/gets are made when you click on buttons in the UI.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...