Setting tag values through REST API

[spbayer]

Is it possible create tags and set tag values through the REST API?

[Ledion_Bitincka]

Yes it is possible, this not publicly documented however this is how the UI adds/deletes fields from the search view

POST /servicesNS/<user>/<app>/search/fields/<field-name>/tags "value=ValueToTagHere&add=tag1&add=tag2&delete=tag3&delete=tag4"

You can have as many add and delete tags as you wish in your POST

[asdfasdf12321]

It's also possible to remove tags more globally with something like:

curl -u admin:changeme -k https://localhost:8089/servicesNS/admin/<app>/search/tags/<tag-name>; -d "delete"

Or the curl equivient of the above answer is:

curl -u admin:changeme -k https://localhost:8089/servicesNS/admin/<app>/search/fields/<field-name>/tags  -d"value=ValueToTagHere&add=tag1&add=tag2&delete=tag3&delete=tag4"

[asdfasdf12321]

The tagger app appears to use this undocumented API.

[ma_anand1984]

@Ledion Bitincka
I dont understand, we usually access tags like | rest splunk_server=local /servicesNS/-/-/search/fields/{field name}/tags

how to user POST is it like "| POST "or "| rest POST". Can you give full command?

[gkanapathy]

It is theoretically possible. In general, anything you can do via the UI can be done via the REST API, since the UI uses the REST API to do all Splunk server and object manipulations. However, in practice, not all object manipulations are currently published.