Splunk-ansible shows one way to accomplish this: Post to https://splunkbase.splunk.com/api/account:login/, converting a splunkbase username+password into an auth token github.com/splunk/splunk-ansible/inventory/environ.py Post to localhost:8089/services/apps/local to install the latest version of an app from splunkbase github.com/splunk/splunk-ansible/roles/splunk_common/tasks/install_apps.yml help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/application-endpoints/application-endpoint-descriptions#ariaid-title6  ... View more

@R15  For monitoring Stanzas, it's still pretty much the same. However, many new type of inputs exists too (modular, scripted, HEC etc...), who do not rely on the fishbucket. ... View more