Getting Data In

Setting tag values through REST API

Engager

Is it possible create tags and set tag values through the REST API?

Tags (2)

Splunk Employee
Splunk Employee

Yes it is possible, this not publicly documented however this is how the UI adds/deletes fields from the search view

POST /servicesNS/<user>/<app>/search/fields/<field-name>/tags "value=ValueToTagHere&add=tag1&add=tag2&delete=tag3&delete=tag4"

You can have as many add and delete tags as you wish in your POST

Explorer

It's also possible to remove tags more globally with something like:

curl -u admin:changeme -k https://localhost:8089/servicesNS/admin/<app>/search/tags/<tag-name>; -d "delete"

Or the curl equivient of the above answer is:

curl -u admin:changeme -k https://localhost:8089/servicesNS/admin/<app>/search/fields/<field-name>/tags  -d"value=ValueToTagHere&add=tag1&add=tag2&delete=tag3&delete=tag4"
0 Karma

Explorer

The tagger app appears to use this undocumented API.

0 Karma

Contributor

@Ledion Bitincka
I dont understand, we usually access tags like | rest splunk_server=local /servicesNS/-/-/search/fields/{field name}/tags

how to user POST is it like "| POST "or "| rest POST". Can you give full command?

0 Karma

Splunk Employee
Splunk Employee

It is theoretically possible. In general, anything you can do via the UI can be done via the REST API, since the UI uses the REST API to do all Splunk server and object manipulations. However, in practice, not all object manipulations are currently published.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!