Using Splunk Enterprise 6.2.1 along with the latest version of the splunk-reskit-powershell toolkit, I (and others on my team with local installations of Splunk Enterprise) are having trouble automating the creation of an index using New-SplunkIndex . The code looks something like this:
Import-Module Splunk
Disable-CertificateValidation
Connect-Splunk -ComputerName $env:COMPUTERNAME -Protocol https -Port 8089
New-SplunkIndex -Name test
The error message:
Invoke-HTTPPost : Exception calling "GetResponse" with "0" argument(s): "The remote server returned an error: (400) Bad Request."
Using verbose output, we get this response:
<response>
<messages>
<msg type="ERROR">
In handler 'indexes': Argument "search" is not supported by this handler.</msg>
</messages>
</response>
Digging into the verbose output, we can see the data being POST'ed to the Splunk endpoint:
VERBOSE: [Invoke-HTTPPost] :: $PostString = search=&name=test
We were able to dig into Splunk-Core.psm1, modify the Invoke-HttpPost function, and get past this error. We did so by essentially commenting out line 224.
Based on our limited research, it seems like the core Invoke-HTTPPost method always includes a search value within message body being POST'ed; however, the REST endpoint for creating a new index rejects the search parameter.
Is there a different way we should be using the toolkit to create an index, or is this a bug within the toolkit itself?
... View more
