How to Access Splunk's REST API

[_gkollias]

I'm working on sending requests to Splunk's REST API for the first time and have a few questions after reading through the tutorial/manual:

1. I can't locate the /services/ directory under /splunk/home/. Is this created out of the box, or something we need to add in /etc/apps?

2. Our dev environment is currently http - will sending requests to http://localhost:8080/... be sufficient for testing?

Any insight is greatly appreciated.

Thanks!

[Damien_Dallimor]

There are numerous examples (using CURL) of using the Splunk REST API in the reference manual.

Via your browser you could also browse to https://localhost:8089/services

Furthermore , we have many language SDK's that make it easier to programmatically interact with the Splunk REST API.

[_gkollias]

Thanks, Damien

Again the example you've posted goes back to using https with port 8089. Our dev environment is currently http - would that make a difference? Here is what I see when I use http://localhost:8080

The path '/en-US/services' was not found.

What should I see here?

[Damien_Dallimor]

8089 is splunk's default management port and the port you access the Rest Api at over https.

Perhaps you are confusing yourself with the Splunk Web port which is by default 8000 and accessed over http.This is not Splunk's Rest Api endpoint.

Please follow and try the advice in my prior post.

[richgalloway]

1. You don't need to create anything for the REST API to work.
2. That should work just fine.

[_gkollias]

Awesome - maybe I'm over-thinking this one. So it's really as simple as if there is no /services/ directory just point it to wherever the saved search is IE http://localhost:8080/en-US/apps/search/saved/searches?

[richgalloway]

You're still over-thinking it. 🙂 There is no services directory, but you must still include it in your query. Follow the manual and you should do fine.