Getting Data In

Is there a REST API to remove missing forwarders?

gthiers
Engager

I have already found documentation on updating the "DMC Forwarder - Build Asset Table" with a post as referenced here:

https://answers.splunk.com/answers/426211/is-there-a-rest-api-call-to-rebuild-the-forwarder.html

This does not actually achieve what I wish to do. We wish to automate via an API call how one rebuilds forwarder assets in Splunk. This is done in Splunk Web in the Distributed Management Console (DMC)->settings->Forwarder Monitoring Setup and then I can set the data collection interval and hit the button "Rebuild Forwarder Assets". I want an API call to do that. Is this possible?

0 Karma
1 Solution

ppeterson
Path Finder

https://host:8089/services/deployment/server/clients?count=0 to pull the full Universal Forwarder list.

https://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTdeploy

deployment/server/clients/{name}

https://:/services/deployment/server/clients/{name}

Get client information or remove a client.

DELETE

Remove the specified client from the deployment server registry. The next time the client "phones home" the record is re-created.

View solution in original post

ppeterson
Path Finder

https://host:8089/services/deployment/server/clients?count=0 to pull the full Universal Forwarder list.

https://docs.splunk.com/Documentation/Splunk/6.5.2/RESTREF/RESTdeploy

deployment/server/clients/{name}

https://:/services/deployment/server/clients/{name}

Get client information or remove a client.

DELETE

Remove the specified client from the deployment server registry. The next time the client "phones home" the record is re-created.

gthiers
Engager

Thanks! @ppeterson

0 Karma

gthiers
Engager

Hi @ppeterson. After looking more into this, it turns out we don't have our deployment server set up because we use a 3rd party tool to set up splunk instances. Is there any other API call that can remove missing forwarders outside of the deployment server route? Or is there a macro that can be utilized?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...