Getting Data In

How do I enable a UF to accept REST API commands?

thisissplunk
Builder

I'm reading through all of the API docs, and I am executing GET API calls against my search head successfully. However, I want to restart the separate universal forwarder and edit inputs.conf via the API but I can't figure out how to enable the REST API on it.nThere are no splunk accounts on it, so what do I need to configure here?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi thisissplunk,

as soon as you changed the default pwd as already suggested, you will be able to do remote API calls. This is the recommend and most secure approach.

There is however one setting in server.conf that allows remote login without changing the default password

Entering danger zone here do this on your own risk!

You can find the option in this http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#General_Server_Configuration docs section, it is the allowRemoteLogin option.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi thisissplunk,

as soon as you changed the default pwd as already suggested, you will be able to do remote API calls. This is the recommend and most secure approach.

There is however one setting in server.conf that allows remote login without changing the default password

Entering danger zone here do this on your own risk!

You can find the option in this http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#General_Server_Configuration docs section, it is the allowRemoteLogin option.

Hope this helps ...

cheers, MuS

pradeepkumarg
Influencer

what do you get when you hit 8089 port on the server where you have UF installed? https://myserver:8089
If I remember correctly, you have to change the default admin password on the forwarder to execute rest api commands.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...