Getting Data In

Trying to create an application with Splunk's Restful API

sloaniebaloney
Engager

I'm new to Splunk and am somewhat familiar with REST. I am trying to create a new application through the Splunk RESTful API. The installation is on windows and I am attempting to do this via curl on the command line.

The command I'm typing in is as follows:

curl -u myUsername:myPassword -k https://localhost:8089/services/apps/local/_new/ -d "name=MyApp"

I have also tried this as a non-post with the curl command

curl -u myUsername:myPassword -k https://localhost:8089/services/apps/local/_new/?name=MyApp

The first curl command returns the xml that mimics what is displayed on the splunk services server. The second one throws an error. I have also tried the first one with url-encoding the posted data with -data-urlencode

Any suggestions would be greatly appreciated.

Thanks,

Ken

Tags (1)

ewoo
Splunk Employee
Splunk Employee

What version of Splunk are you using? The following instructions work for 4.1.6.

To create an app, you must provide a name for the new app and a template from which to start:

$ curl -k -u admin:admin -X POST https://localhost:8089/services/apps/local -d 'name=myapp&template=barebones'

This will create an app named 'myapp' based on the barebones template.

In general, '_new' is used to determine what arguments are required to create a new object (or edit an existing one). It is not used to create the objects themselves.

$ curl -u admin:admin -k https://localhost:8089/services/apps/local/_new | xmllint --format -
[snip]
    <s:key name="eai:attributes">
      <s:dict>
        <s:key name="optionalFields">
          <s:list>
            <s:item>author</s:item>
            <s:item>description</s:item>
            <s:item>install</s:item>
            <s:item>label</s:item>
            <s:item>manageable</s:item>
            <s:item>template</s:item>
            <s:item>visible</s:item>
          </s:list>
        </s:key>
        <s:key name="requiredFields">
          <s:list>
            <s:item>name</s:item>
          </s:list>
        </s:key>
        <s:key name="wildcardFields">
          <s:list/>
        </s:key>
      </s:dict> 
    </s:key>
[snip]

sloaniebaloney
Engager

Thank you. This helped an I can now create an application.

Ken

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...