Getting Data In

Can we use "| rest" to call Splunk instances other than local?

philip_wong
Communicator

So far, I'm only able to run these against local Splunk.
It has nothing returned when I replaced "local" with other hostname.
Is it possible to run these against remote Splunk and forwarder?
Any requirement to make this work? I've already set allowRemoteLogin = always

| rest /services/data/indexes count=0 splunk_server=local
| rest /services/admin/inputstatus/TailingProcessor:FileStatus timeout=300 splunk_server=local

Also, what if management port is something else than 8089, e.g. 9001?

Tags (2)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I believe it works only for the Current Splunk instance (e.g. Search head where query is running) and it's search peers (e.g. indexers). Run this and see what all splunk_server values it can support.

|rest /services/data/indexes count=0 splunk_server=*| stats count by splunk_server

Only the server name listed here will work as argument

View solution in original post

meleperuma
Explorer

Yes you can. But you need to make sure the other instance that you are trying to run it against is a Search Peer to the instance you are executing from. That means you cant run it for a remote Forwarder.

you can run it against any hostname you get from below search:

|rest /services/data/indexes count=0 splunk_server=*
| stats count by splunk_server

Example:

|rest /services/data/indexes count=0 splunk_server=*| stats count by splunk_server

alt text

| rest splunk_server=splunk05 /servicesNS/-/-/configs/conf-props search="eai:acl.app=search"
| search title=*
| rename eai:acl.app as app, eai:acl.perms.read as read, eai:acl.sharing as sharing
| fields - updated published id eai*
| fields title author splunk_server app read sharing *
| eval title="[".title."]"
| foreach * [eval title=if("<>"="author" OR "<>"="splunk_server" OR "<>"="app" OR "<>"="read"  OR "<>"="sharing" OR "<>"="title" OR '<>'="",title,mvappend(title,"<>"."="."\"".'<>'."\""))]
| fields title author splunk_server app read sharing

alt text

somesoni2
SplunkTrust
SplunkTrust

I believe it works only for the Current Splunk instance (e.g. Search head where query is running) and it's search peers (e.g. indexers). Run this and see what all splunk_server values it can support.

|rest /services/data/indexes count=0 splunk_server=*| stats count by splunk_server

Only the server name listed here will work as argument

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...