How do I create AWS inputs using Splunk's REST API?

[ejwade]

I would like to dynamically create AWS Metadata inputs using Splunk's REST API. When referencing Splunk's documentation, it looks to be incomplete and incorrect.

https://docs.splunk.com/Documentation/AddOns/released/AWS/APIreference

Has anyone done this?

[ejwade · Accepted solution]

After working with support, it sounds like Splunk will update their documentation. For now, I provided the following for reference.

Create an IAM role:

curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_iam_roles  -d name=<name> -d arn=<arn>

Create a Metadata input:

curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_aws_metadata -d account=<account> -d aws_iam_role=<aws_iam_role> -d index=<index> -d regions=<regions> -d name=<name>