Is there a REST call to create an index dynamically?

[a212830]

Hi,

Is there a way to automate the creation (and parameters) of new indexes through REST (hopefully pushed through the Cluster Manager)?

[sloshburch]

I'm not sure POST is supported, but I'd guess http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Findexes for updating the master nodes index config.

If not, then maybe you can just use http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTconf to do the same for generic config updates.

Then there might be an endpoint for pushing out the updated config. Not sure if this is it: http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Fgeneration
If not, then the cron approach might work.

[Jeremiah]

I haven't seen an option like that. The cluster master does have some REST endpoints for reading index data, but they are all GET methods.

http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Findexes.2F....

You can individually create the index on each indexer via an API call, but that's probably risky given that the index configurations between all of servers need to match exactly. I've also had limited success creating the index on a host via API without having to restart the indexer.

You're probably stuck with managing an indexes.conf file on your cluster master and building your automation around that.

[masonmorales · Accepted solution]

Yes, take a look at: http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTconf

[Jeremiah]

This would work to create an index in a cluster? Would you have to push the change to each peer or is there an endpoint here that lets you push a change to the cluster master that is then distributed to the indexers?

[masonmorales]

I'm not sure if there is a way to do that directly on the master node, but you could probably use it to update the indexes.conf file on the master node (will likely be under $SPLUNK_HOME/etc/system/local/indexes.conf), then have a CRON job on the master node that periodically copies that indexes.conf file that you created through the REST API to $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf. Take a look at: http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Updatepeerconfigurations