×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Sanz
Explorer
Member since: ‎08-02-2022
‎08-22-2022
Community Statistics
Posts 6
Solutions 0
Karma Given 1
Karma Received 1
Member Since ‎08-02-2022
View All

Re: How do I create an index using REST API?

by in Splunk Cloud Platform
‎01-18-2024 08:23 PM
‎01-18-2024 08:23 PM
Are you certain you had the :8089 as part of your curl url? AND you used the correct url? The redirection response you have provided is identical to the one that Splunk Web (i.e. port 443 OR no port specified with HTTPS) would give in response to a request for /servicesNS/nobody/search/data/indexes (Which would be the enterprise API url instead of the cluster blaster one you state in your post.) Deliberately omitting the :8089 from the cluster_blaster_indexes request against my classic stack I get the following: $ curl https://redacted.splunkcloud.com/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json <!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta http-equiv="refresh" content="1;url=https://redacted.splunkcloud.com/en-US/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json"><title>303 See Other</title></head><body><h1>See Other</h1><p>The resource has moved temporarily <a href="https://redacted.splunkcloud.com/en-US/services/cluster_blaster_indexes/sh_indexes_manager?output_mode=json">here</a>.</p></body></html>   ... View more

Re: Lookup files permissions- Is there a way to vi...

by SplunkTrust in Splunk Search
‎08-22-2022 10:54 PM
‎08-22-2022 10:54 PM
It would be really easy to do that on the command line.  If you don't have command line access, another method could be to use the REST API directly: data/lookup-table-files.   ... View more

Re: Savedsearches used in Dashboard

by in Splunk Search
‎08-02-2022 07:26 AM
‎08-02-2022 07:26 AM
Try this | rest /servicesNS/-/-/data/ui/views splunk_server=local | search title="test_dashboard" | rename eai:acl.app AS app, eai:data AS data | fields title app author data | where match(data,"\|\s*savedsearch\s") OR match(data,"ds\.savedSearch") OR match(data,"search ref\=") | rex field=data "\|\s+savedsearch\s+(?<savedsearch1>\S+)" | rex field=data "(\s|\")ref((\":)|\=)\s*\"(?<savedsearch2>[^\"]+)" | eval savedsearch=coalesce(savedsearch1, savedsearch2) | stats count by savedsearch | fields - count ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎08-22-2022 04:03 AM
Karma from
View All
Karma given to
View All