I created a new index, but why am I not able to access it via REST API to post data to the new index?

[sh0stat_25]

I created a new index called perftestresults and I am able to see it when I search using the below Splunk command, but when I run a post command to the index, I get the below error:

Splunk Command

| eventcount summarize=false index=* index=_* | dedup index | fields index

Error Returned:

<msg type="WARN">supplied index 'perftestresults' missing</msg>

Post I am sending:

POST https://test:8089/services/receivers/simple?index=perftestresults
payload= "This is a test

[martin_mueller]

Talk to your admin about

• Where you are trying to send to
• Where they defined the indexes
• If you want to migrate to the 6.3 HTTP Event Collector

http://dev.splunk.com/view/event-collector/SP-CAAAE6M

[martin_mueller]

If the indexers' REST endpoint listing indexes doesn't list that index then I'd say that indexer doesn't have that index defined.

[sh0stat_25]

still not able to see it. trying a few other things but the API is not able to see the new index that was created.

[sh0stat_25]

where are the defined the indexes - indexes are deined in 4 indexers

where you are trying to send to - sending to indexer

[martin_mueller]

Did you define the index on the receiving instance?

[sh0stat_25]

That i am not sure about as i am only the consumer. i will have to check with my Splunk SA.

would you main explaining how i would go about doing that so i can have him cross check

[martin_mueller]

Are you on one standalone Splunk or in a distributed environment?

[sh0stat_25]

distributed environment

[martin_mueller]

What do you get when you GET https://test:8089/services/data/indexes against the same Splunk instance you POSTed to?

[sh0stat_25]

i get other indexes which are listed but i dont get the one that i am looking for which is the "perftestresults" but it is displayed when i search splunk for indexes which is strange.