ACS: Updating multiple indexes

[morethanyell]

Dear all,

I think I have a working python script that will update `searchableDays` of multiple indexes (over 200). The script will loop through a CSV file that contains all the indexes name. I tested it to one and it worked.

The `response.reason` was "202 Accepted". It did not return any link/URL or anything that will tell me if the process has completed...sort of "status" where I can request.get over-and-over until it says the change has completed.

If Splunk ACS doesn't provide this, can I simply throw all the request.patch for all 200+ indexes? Will the SplunkCloud server be able to handle that (asynchronously)?

Or is there a better way of doing this, i.e.:

// PSUEDO CODE
// setup splunk_api_url, mystack, header, PAYLOAD, etc

for each row in CSV:
    idx = row.value
    url = splunk_api_url/mystack/adminconfig/v2/indexes/ + idx
    response = request.patch(url, header,  json=PAYLOAD)
    // here, wait for the update to complete before moving on to the next index

Thanks in advance!

[livehybrid]

Hi @morethanyell 

I would recommend using the ACS CLI for these type of changes - there is a specific "acs indexes bulk-update" command for this task although its not clear if it pushes all in one go or iterates over each of them but there is a warning to note in the docs:

In some cases, when performing bulk index operations on Classic Experience, the operation completes successfully for the first index (status code 202), but the operation fails for subsequent indexes

Are you on Classic or Victoria?

If you did want to stick to using the API directly then its worth checking out https://github.com/splunk/acs-cicd-starter/blob/e6bf9211d996857622655afc686c219029da2b49/.github/wor... - in this Splunk-provided example there is a loop over files to update the retention of an index, which would suggest this is a supported approach, but as I mentioned, to save yourself re-inventing the wheel you might be better with the ACS CLI tool.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[isoutamo]

If I recall right you can do this quite easily with acs command.

Just create/get current indexes.conf file as json and update those values into it. Then push it back with acs command to SCP and that's it.  No need to do any coding etc.

https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/9.3.2408/adm...

But you must test this 1st with some test indexes.

https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/9.3.2408/adm...

That was instructions how to manage several indexes at time.

And it you want to use Terraform that is also one option for this. There is some words about it in the beginning of this page.