restmap.conf

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains example REST endpoint configurations.
#
# To use one or more of these configurations, copy the configuration block into
# restmap.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

# The following are sample rest endpoint configurations.  To create your own endpoints, modify 
# the values by following the spec outlined in restmap.conf.spec.

############################
#  Srcipt-specific Settings
############################

# This examples sets up endpoints for the globe script (see Splunk Developer documentation for more details).

[script:globe]
match = /globe/main
handler = handlers.globe
requireAuthentication = false

[script:iploc]
match = /globe/iploc
handler = handlers.iploc
requireAuthentication = false

[script:jquery]
match = /globe/jquery.js
handler = handlers.jquery
requireAuthentication = false

[script:lastips]
match = /globe/lastips
handler = handlers.lastips
requireAuthentication = false

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.2
#
# This file contains possible attribute and value pairs for creating new rest endpoints.
#
# There is a restmap.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place a restmap.conf in $SPLUNK_HOME/etc/system/local/. For help, see
# restmap.conf.example. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

# NOTE: You must register every REST endpoint via this file to make it available.

###########################
# Global stanza

[global]
    * This stanza sets global options. 
      * Follow this stanza name with any number of the following attribute/value pairs.

allowGetAuth=<true | false>
    * Allow user/password to be passed as a GET paramater to endpoint services/auth/login.  
    * Posting GET arguments might get logged, and setting this to true, while convenient, may 
    result in user/password getting logged as cleartext in Splunk's logs *and* any proxy servers
    in between. 
    * Defaults to false.  

pythonHandlerPath=<path to 'main' python script handler>
    * Used by the script handler to determine where the actual 'main' script is located.  
    * Typically, you should not need to change this.
    * Defaults to $SPLUNK_HOME/bin/rest_handler.py.

###########################
# Per-endpoint stanzas

  
# The handler is responsible for implementing arbitrary namespace underneath each REST 
# endpoint. 
# For example, if I register /foo, my handler may implement /foo/a, /foo/b, /foo/x/y/z, ...

[Handler:uniqueName]
    # Stanza definitions are broken down into 2 parts - the handler and a unique name.    
    * There are 2 types of handlers available:
    [script:<name>] and [search:<name>]
        * See below for handler-specific attribute/value pairs.
    * NOTE: The uniqueName must be different for each handler.
    * The following attribute/value pairs can be used to set up handlers.
    
match=<regex>
    * This determines the URL endpoint that calls this handler. 
    * For instance if 'match=/foo', then https://$SERVER:$PORT/services/foo calls this handler.  
    * NOTE: All matches are anchored at the beginning of the line - eg a '^' character is 
    automatically appended to the beginning of the regex.

requireAuthentication= <true | false>
    * This OPTIONAL tag determines if this endpoint requires authentication or not.  
    * It defaults to 'true'.

capability=<capabilityName>
capability.<post|delete|get|put>=<capabilityName>
    * Depending on the HTTP method, check capabilities on the authenticated session user.
    * If you use 'capability.post|delete|get|put,' then the associated capability is checked 
    against the authenticated user's role. 
    * If you just use 'capability,' then all calls get checked against this capability (regardless 
    of the HTTP method).

xsl=<path to XSL transform file>
    * THIS IS OPTIONAL.
    * Perform an optional XSL transform on data returned from the handler.
    * Only use this if the data is XML.

#
# The following attribute/value pairs are specific to handler type:
#

############################
#'script'
# The built-in script handler. 
# Call the specified script when executing this endpoint.
#

[script:<uniqueName>]

scripttype=python
    * Tell the system what type of script to execute when using this endpoint.
    * Defaults to python.
    
handler=ScriptFile.ClassName
    * The name and class name of the file to execute.  
    * The file *must* live in an application's subdirectory named 'rest/'.  
    * For example $SPLUNK_HOME/etc/apps/$MYAPP/default/rest/TestHandler.py 
    has a class called MyHandler (which, in the case of python must be derived from a base class 
    called 'splunk.rest.BaseRestHandler').  
    * The tag/value pair for this is: "handler=TestHandler.MyHandler".

script=<path to a script executable>
    * This is optional and rarely used.
    * Optionally you can execute a script which is *not* derived from 'splunk.rest.BaseRestHandler'.
    * Put the path to that script here.  
    * Do not use this unless you know what you are doing.

#############################
#'search'
# The built-in handler for executing an arbitrary search. 
# Execute the specified search when this endpoint is executed.
#

[search:<uniqueName>]

match=<regex with groups>
     * Even though 'match' is specified above as available in any stanza, it is used differently here.  
    * Any regex match group is applied to the 'searchstring' value.  
    * So, the first '(..)' gets substituted in \1 and the second '(...)' gets substituted in \2, etc.

searchstring=search string \1 \2 \3
    * Any Splunk search.  
    * See 'match' above for how substitution occurs.