Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Where do I point my REST API if I have search head...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
If I have Search-Head-Pooling configured, where do I point my REST API? To a physical server? If so, doesn't that defeat the purpose?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well , you'd likely connect through your load balancer which would route your connection request to 1 of the instances of the Search Head Pool and maintain affinity to that instance for the duration of your REST API session connection.
Or , you could connect to each Search Head instance directly. Really depends on the use case you are trying to satisfy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well , you'd likely connect through your load balancer which would route your connection request to 1 of the instances of the Search Head Pool and maintain affinity to that instance for the duration of your REST API session connection.
Or , you could connect to each Search Head instance directly. Really depends on the use case you are trying to satisfy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thought so. OK, thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
8000 is your Splunk Web port. You'd need a Load Balancing rule for HTTPS protocol on port 8089 (or whatever port you have setup for you management port) and with session affinity/sticky session configured.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, my load-balancer listen for the management port - it listens on port 8000 - do people setup a separate load-balance for the REST API, or am I missing something?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
