Getting Data In

Is there a REST call to create an index dynamically?

Champion

Hi,

Is there a way to automate the creation (and parameters) of new indexes through REST (hopefully pushed through the Cluster Manager)?

0 Karma
1 Solution

Influencer
0 Karma

Ultra Champion

I'm not sure POST is supported, but I'd guess http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Findexes for updating the master nodes index config.

If not, then maybe you can just use http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTconf to do the same for generic config updates.

Then there might be an endpoint for pushing out the updated config. Not sure if this is it: http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Fgeneration
If not, then the cron approach might work.

0 Karma

Motivator

I haven't seen an option like that. The cluster master does have some REST endpoints for reading index data, but they are all GET methods.

http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTcluster#cluster.2Fmaster.2Findexes.2F....

You can individually create the index on each indexer via an API call, but that's probably risky given that the index configurations between all of servers need to match exactly. I've also had limited success creating the index on a host via API without having to restart the indexer.

You're probably stuck with managing an indexes.conf file on your cluster master and building your automation around that.

0 Karma

Influencer
0 Karma

Motivator

This would work to create an index in a cluster? Would you have to push the change to each peer or is there an endpoint here that lets you push a change to the cluster master that is then distributed to the indexers?

0 Karma

Influencer

I'm not sure if there is a way to do that directly on the master node, but you could probably use it to update the indexes.conf file on the master node (will likely be under $SPLUNKHOME/etc/system/local/indexes.conf), then have a CRON job on the master node that periodically copies that indexes.conf file that you created through the REST API to `$SPLUNKHOME/etc/master-apps/_cluster/local/indexes.conf`. Take a look at: http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Updatepeerconfigurations