This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13
The /services/properties/ endpoint provides access to all configuration files values and settings. Configuration files are combined by name from all relevant directories in $SPLUNK_HOME/etc/, so all versions of alert_actions.conf are concatenated. To access a specific file, use the propertiesNS endpoint (described below).
Changes made via the properties endpoint are equivalent to changing the conf files on the filesystem. Any change that requires splunkd to be restarted when editing the conf file directly also requires restart when done through the API. To learn more about configuration files, please see this page.
This endpoint provides a high level view of every configuration file in $SPLUNK_HOME/etc/.
Returns an Atom feed of configuration files.
Response codes:
| Response | Status |
| 200 | User successfully authenticated. |
curl -k -H "$SPLUNK_AUTH_HEADER" "$SPLUNK_URL/properties/"
<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest">
<title>properties</title>
<id>https://localhost:8089/services/properties/</id>
<updated>2008-06-18T11:24:52-0700</updated>
<generator version="37999"/>
<author>
<name>Splunk</name>
</author>
<entry>
<title>alert_actions</title>
<id>https://localhost:8089/services/properties//alert_actions</id>
<updated>2008-06-18T11:24:52-0700</updated>
<link href="https://localhost:8089/services/properties//alert_actions" rel="alternate"/>
</entry>
<entry>
<title>app</title>
<id>https://localhost:8089/services/properties//app</id>
<updated>2008-06-18T11:24:52-0700</updated>
<link href="https://localhost:8089/services/properties//app" rel="alternate"/>
</entry>
....
This is a truncated example of the XML returned from a request to services/properties/.
The /services/properties/$FILE_NAME endpoint provides access to properties for any specified configuration file. Set $FILE_NAME to any existing configuration file. For a list of available configuration files, see this page.
Returns an Atom feed of stanzas contained in file_name.
Response codes:
| Response | Status |
| 200 | OK. |
curl -k -H "$SPLUNK_AUTH_HEADER" "$SPLUNK_URL/properties/alert_actions.conf"
Creates a new stanza within $FILE_NAME. Set the attributes for the stanza by using $STANZA_NAME (below).
| Form | Arguments |
| $STANZA_NAME | The name of the stanza to create. |
Response codes:
| Response | Status |
| 201 | Stanza was successfully created; will be followed by header Location: /services/properties/$STANZA_NAME |
| 303 | Stanza already exists; will be followed by header Location: /services/properties/$STANZA_NAME |
| 400 | Form arguments were invalid |
NOTE: This acton has no response body, unless error occurs.
The /services/properties/$FILE_NAME/$STANZA_NAME/ endpoint provides access to the configuration values for a stanza within a specific file. Specify which stanza by setting $STANZA_NAME.
Returns an Atom feed of key/value pairs contained in the stanza
Response codes:
| Response | Status |
| 200 | OK |
| 404 | $STANZA_NAME was not found in $FILE_NAME. |
Adds or updates key/value pairs in the $STANZA_NAME. One or more key/value pairs may be passed at one time to this endpoint.
| Form | Arguments |
| $ATTRIBUTE=$VALUE | The argument name is the key to update; the value is the value to be set. |
Response codes:
| Response | Status |
| 200 | Key value was successfully added/updated. |
| 400 | Form request was badly formed. |
| 404 | The stanza was not found. |
| 409 | One or more of the input values failed validation. |
NOTE: Upon successful write (HTTP 200), the response will be identical to the GET response; non-200 response will be standard message format.
curl -k -H "$SPLUNK_AUTH_HEADER" -X POST -d "from=JohnLocke" "$SPLUNK_URL/properties/alert_actions/email/"
Overwrites the entire stanza block for $STANZA_NAME. If the stanza doesn't already exist, it will be created. The PUT method is also useful for adding inline comments.
| Form | Arguments |
| <raw_payload> | The raw text of the stanza, excluding the stanza header declaration. |
Response codes:
| Response | Status |
| 200 | Stanza was updated |
| 201 | Stanza was created; will be followed by header Location: /services/properties/[stanza_name]. This is redundant, but follows spec. |
| 404 | The file_name was not found. |
Upon successful write (HTTP 20x), the response will be identical to the GET response; non-200 response will be standard message format.
curl -k -H "$SPLUNK_AUTH_HEADER" -X PUT -d "from=JohnLocke" "$SPLUNK_URL/properties/alert_actions/email/"
The /services/properties/$FILE_NAME/$STANZA_NAME/$KEY_NAME endpoint provides access to individual key/values within a specific $STANZA_NAME in the specified $FILE_NAME.
Returns the value of the key in plain text.
| Response | Status | |
| 200 | OK | |
| 404 | Key/stanza/file was not found. |
Updates an existing key value.
| Form | Arguments |
| value | The argument name is the key to update; the value is the value to be set. |
Response codes:
| Response | Status |
| 200 | Key value was successfully added/updated. |
| 400 | Form request was badly formed. |
| 404 | The stanza was not found. |
| 409 | The input value failed validation. |
Upon successful write (HTTP 200), the response will be identical to the GET response; non-200 response will be standard message format.
curl -k -H "$SPLUNK_AUTH_HEADER" -X POST -d "value=JohnLocke" "$SPLUNK_URL/properties/alert_actions/email/from/"
Adds a new key to the stanza, or updates an existing key.
| Form | Arguments |
| <raw_payload> | The raw value of the key. |
Response codes:
| Response | Status |
| 200 | Key was updated. |
| 201 | Key was created. |
| 404 | The file_name or stanza_name was not found. |
| 409 | The value failed validation. |
Upon successful write (HTTP 20x), the response will be identical to the GET response; non-200 response will be standard message format.
curl -k -H "$SPLUNK_AUTH_HEADER" -X PUT -d "JohnLocke" "$SPLUNK_URL/properties/alert_actions/email/from/"
Use the /services/propertiesNS/<app_name>/<conf_name>/<stanza_name>/<key_name> endpoint to access a file in a specific application. You can specify any part of the endpoint, from <app_name> through to <key_name>. Use the same methods as the endpoints above.