Getting Data In

How do you use the indexing/preview API endpoint?

thisissplunk
Builder

I'd like to create my inputs and sourcetypes via the API in a clustered environment. Then I'd like to send a test file up to splunk and preview how the data will be parsed before I start indexing the data.

Is this what the indexing/preview API endpoint does? If it does, it does not do a stellar job of explaining it. For instance, how do I tell it what input stanza (and therfore sourcetype) to mimic? I can only guess by the following example that it uses some default sourcetype or something:

curl -u admin:pass https://localhost:8089/services/indexing/preview -d input.path=/Applications/splunk/var/log/splunk/metrics.log

"Details" are here: http://docs.splunk.com/Documentation/Splunk/7.1.0/RESTREF/RESTinput

Tags (3)
0 Karma

somesoni2
Revered Legend

From what I can understand from seeing splunkd_ui_access.log file for my attempt to use Splunk Web's Add Data wizard, using above REST Endpoint, you specify which file to preview (like upload option in Add data). In above case, input.path is providing the file path. With just passing the path, Splunk would try to assign a sourcetype based on file name/content. You can see the sourcetype assigned by Splunk when you query indexing/preview/{job_id_from_above_curls_response}. You can pass optional parameter to your POST request props.<props attr> which are basically the sourcetype attributes that you pass to your preview, like you'd do in Advanced tab on the Add Data wizard's Set Sourcetype page. Don't see any option to specify sourcetype. Again, these are just my observation.

thisissplunk
Builder

Ok, I'll give adding the specific stanza lines a shot. Are you aware if this would actually index any data or not?

0 Karma

somesoni2
Revered Legend

This would not.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...