How do you use the indexing/preview API endpoint?

[thisissplunk]

I'd like to create my inputs and sourcetypes via the API in a clustered environment. Then I'd like to send a test file up to splunk and preview how the data will be parsed before I start indexing the data.

Is this what the indexing/preview API endpoint does? If it does, it does not do a stellar job of explaining it. For instance, how do I tell it what input stanza (and therfore sourcetype) to mimic? I can only guess by the following example that it uses some default sourcetype or something:

curl -u admin:pass https://localhost:8089/services/indexing/preview -d input.path=/Applications/splunk/var/log/splunk/metrics.log

"Details" are here: http://docs.splunk.com/Documentation/Splunk/7.1.0/RESTREF/RESTinput

[somesoni2]

From what I can understand from seeing splunkd_ui_access.log file for my attempt to use Splunk Web's Add Data wizard, using above REST Endpoint, you specify which file to preview (like upload option in Add data). In above case, input.path is providing the file path. With just passing the path, Splunk would try to assign a sourcetype based on file name/content. You can see the sourcetype assigned by Splunk when you query indexing/preview/{job_id_from_above_curls_response}. You can pass optional parameter to your POST request props.<props attr> which are basically the sourcetype attributes that you pass to your preview, like you'd do in Advanced tab on the Add Data wizard's Set Sourcetype page. Don't see any option to specify sourcetype. Again, these are just my observation.

[thisissplunk]

Ok, I'll give adding the specific stanza lines a shot. Are you aware if this would actually index any data or not?

[somesoni2]

This would not.