Can I create a new index using the REST API?

[hiddenkirby]

I am using something pretty similar to this in my transforms.conf to dynamically put events in the desired indexes.

https://answers.splunk.com/answers/150266/dynamic-index-assignment-based-on-event-or-log-prefix.html

There are situations where the index doesnt' quite exist yet. When that happens the file sink-holes into the ether, not to be ingested, nor kept in the original directory.

I'm looking to write some code to get in front of it, and

• watch the directories
• ensure the appropriate index exists
• then drop the file in the Splunk-watched directory (or maybe use the api/cli to directly ingest the file in Splunk to the correct index).

This is not a clustered Splunk, though if required, it is possible. (I came across this question https://answers.splunk.com/answers/387133/how-to-create-index-using-rest-api-in-a-clustered.html?utm...)

My concern is that the solution is pointing to something like editing the indexes.conf file and rebooting splunk through the command line. Is this possible via REST API? I would also prefer not to have to reboot and kick the users off. What does the Splunk UI use to do it?

[jkat54 · Accepted solution]

You don't need to reboot splunk for index additions.

You just need to update indexes.conf and then hit the debug refresh endpoint for indexes or for everything if you prefer.

[jkat54]

Something like a post to http://splunkserver:8000/en-US/debug/refresh?entity=indexes should work

[hiddenkirby]

This is helpful, thank you. Is that what the UI does when you create an index?

[jkat54]

Yes or something very similar.

You could install something like Teleriks Fiddler on your device and see exactly what posts/gets are made when you click on buttons in the UI.