- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can a universal forwarder be restarted via REST API?
xiyangyang
Path Finder
12-21-2017
11:53 PM
Can UF be restart via REST API?
What other things can be done to UF via REST API?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

harsmarvania57
Ultra Champion
12-22-2017
12:59 AM
Hi @xiyangyang,
Yes, you can restart UF via REST API (ref doc. http://docs.splunk.com/Documentation/Splunk/7.0.1/RESTREF/RESTsystem#server.2Fcontrol.2Frestart )
curl -k -u admin:changeme https://localhost:8089/services/server/control/restart -X POST
If you want to run above command from remote server then you need to change default password for admin user otherwise you will get below error.
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="WARN">Remote login has been disabled for 'admin' with the default password. Either set the password, or override by changing the 'allowRemoteLogin' setting in your server.conf file.</msg>
</messages>
</response>
I hope this helps.
Thanks,
Harshil
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

gcusello

SplunkTrust
12-21-2017
11:58 PM
Hi xiyangyang,
I don't know why you want to restart a UF using REST API, I think that the easiest way is a remote shell script.
Anyway you can find all the information about REST API features at http://dev.splunk.com/restapi .
Bye.
Giuseppe
