Splunk Search

Is it possible to use POST and DELETE with "rest" search command?

Path Finder

There is a nice search command for interacting with REST API: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rest

But it seems that it can only do GET queries. Is it possible to do POST and DELETE queries in search?

To be more specific, I need to dynamically create and remove inputs in my application.

Tags (2)
0 Karma

Path Finder

Yes, you may use a REST call to delete. See DELETE for the "saved/searches/{name}" endpoint.

Please keep in mind that the Splunk Search interface command line provides a 'rest' command, but this is read only, and is not a true REST client. Please use your favorite common purpose REST client. (curl, Postman, any HTTP library)

0 Karma


No, the rest command supports GET requests only.

Splunk Employee
Splunk Employee

Use something like curl from the command line, or some other framework to issue POST / DELETE requests to the REST API over the network (to the management port of the Splunk instance, default 8089).

0 Karma

Super Champion

here is a doc on using curl in the command line http://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing

0 Karma

Path Finder

Thanks for the clarification!
Is there a way to achieve the same goal without "rest" command then?

0 Karma


Try https://splunkbase.splunk.com/app/2775/ it contains a more generic Splunk REST command 🙂

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!