I would like to dynamically create AWS Metadata inputs using Splunk's REST API. When referencing Splunk's documentation, it looks to be incomplete and incorrect.
https://docs.splunk.com/Documentation/AddOns/released/AWS/APIreference
Has anyone done this?
After working with support, it sounds like Splunk will update their documentation. For now, I provided the following for reference.
Create an IAM role:
curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_iam_roles -d name=<name> -d arn=<arn>
Create a Metadata input:
curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_aws_metadata -d account=<account> -d aws_iam_role=<aws_iam_role> -d index=<index> -d regions=<regions> -d name=<name>
After working with support, it sounds like Splunk will update their documentation. For now, I provided the following for reference.
Create an IAM role:
curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_iam_roles -d name=<name> -d arn=<arn>
Create a Metadata input:
curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_aws_metadata -d account=<account> -d aws_iam_role=<aws_iam_role> -d index=<index> -d regions=<regions> -d name=<name>