• Overview
  • Introduction and overview
    • Components
    • Appearance
    • REST API
    • Applications
    • Help
• Architecture
  • Components
    • Processes
    • Configuration files
• Splunk Web appearance
  • How Splunk Uses Skins
    • Skins css Files
    • Images/skins directory
  • Add or remove themes
    • Create a new skin
    • Example
  • Dashboard customization
    • Configuration
    • List modules
    • Add search modules
    • Add html modules
    • Link dashboard to user
    • Mask default dashboards
• REST API
  • Splunk's REST API
    • Using REST Methods
    • Splunk REST endpoint mappings
    • HTTP ports Splunk uses
    • Examples
  • Get started
    • Send a request
    • Get a response
  • Output formats via XML
    • Example Generic Response
    • Example Generic Response with Messaging
    • Generic Response with Messaging (via error codes)
    • Example Atom Feed Response
    • Example Atom Feed with Messaging
    • Example Atom Entry Response
  • SDKs
    • Python SDK
  • Create a custom endpoint
    • Make a custom application directory
    • Write a handler script
    • Configure restmap.conf
    • Restrict endpoint access
    • Add supporting configuration files
• Auth
  • Authentication Methods
    • HTTP header auth
    • HTTP digest
    • URL Parameters
  • Authentication Endpoint
    • Login
  • Authentication examples
    • Command Line
    • Python SDK
    • Other Python example
• Properties
  • Properties Endpoint
    • Properties
    • $FILE_NAME
    • $STANZA_NAME
    • $KEY_NAME
    • PropertiesNS
  • Configuration file access with Python
    • Configuration
    • Example
• Search
  • Search Overview
    • Handling Search Results
    • Result Formats
  • Search Endpoint
    • Jobs
    • Search ID
    • Events
    • Results
    • Timeline
    • Summary
    • Control
  • Search with the Python SDK
    • Create a search
    • Work with search results
    • Examples
  • Custom search scripts
    • Configuration files
    • Working with results
    • Authenticate
    • Example
• Saved
  • Saved Endpoint
    • Searches
    • $SAVED_SEARCH_NAME
• Streams
  • Streams Endpoint
    • Search
    • Livetail
• Applications
  • Developer applications overview
  • Applications Endpoint
    • Local
    • $APP_NAME
    • Remote Entries
    • Remote $APP_NAME
    • Category Path
    • Remote Login
• SplunkBase
  • SplunkBase API
    • Apps
    • Types
    • Category Path
    • Entries
    • App Name
• Legacy
  • Legacy methods
    • $LEGACY_METHOD_NAME

Applications Endpoint

Use the /services/apps/ endpoint to interact with any application installed in $SPLUNK_HOME/etc/apps/. Download applications from SplunkBase. If you want to make your own application, please see the Admin Manual section on applications.

Local

The /services/apps/local endpoint lists the applications that are installed on the local system.

GET

The following are available arguments to GET.

Response codes:

Examples

See installed apps:

curl -k -H "$SPLUNK_AUTH_HEADER" "https://localhost:8089/services/apps/local"

Search installed apps by name:

curl -k -H "$SPLUNK_AUTH_HEADER" "https://localhost:8089/services/apps/local?q=co"

Response is an Atom feed of all the matching applications.

$APP_NAME

The /services/apps/local/$APP_NAME endpoint provides access to an installed application on the local system.

GET

Lists detailed information about an application.

Response codes:

Example

An Atom entry of the application information

Get information about a particular app:

curl -k -H "$SPLUNK_AUTH_HEADER" "https://localhost:8089/services/apps/local/code"

POST

Provides control actions on an application.

Response codes:

Examples

Disable an app:

curl -k -H "$SPLUNK_AUTH_HEADER" -X POST -d "action=disable" "https://localhost:8089/services/apps/local/code"

Enable an app:

curl -k -H "$SPLUNK_AUTH_HEADER" -X POST -d "action=enable" "https://localhost:8089/services/apps/local/code"

Sample response to enable:

<response>
    <messages>
        <msg type="INFO">Application 'foo' was enabled</msg>
    </messages>
</response>

DELETE

Permanently removes an application from the local system.

Response codes:

Example

Uninstall an app:

curl -k -H "$SPLUNK_AUTH_HEADER" -X DELETE "https://localhost:8089/services/apps/local/code"

Sample response to delete:

<response>
    <messages>
        <msg type="INFO">Application 'foo' was deleted</msg>
    </messages>
</response>

Remote Entries

The /services/apps/remote/entries endpoint lists the applications that are available on the remote Splunk application repository. The location of the Splunk repository is specified in server.conf, and is a list of 1 or more base URLs that conform to the Splunk application listing format (Atom feed).

GET

Lists the applications that are installed on the remote systems.

Response codes:

Remote $APP_NAME

The /services/apps/remote/entries/$APP_NAME endpoint provides access to a remote application package

GET

Lists detail information about an application.

Response codes:

Example

Browse SplunkBase:

curl -k -H "$SPLUNK_AUTH_HEADER" "https://localhost:8089/services/apps/remote/entries"

POST

Provides control actions on a remote application. The actions are intended to be performed on the local system, and should not alter the state of the remote application package.

Response codes:

Example

Install an app from SplunkBase:

token=<url-encoded-auth-token-from-login>

curl -k -H "$SPLUNK_AUTH_HEADER" -X POST -d "action=install&auth=$token" "https://localhost:8089/services/apps/remote/entries/Splunk+for+UNIX"

Sample response to install:

<response>
    <messages>
        <msg type="INFO">Application 'foo' was installed</msg>
    </messages>
</response>

Category Path

The /services/apps/remote/categories/category_path endpoint provides a list of Application categories defined on the remote systems.

GET

Returns an Atom feed of category names. If category_path is omitted then the top level list of categories is returned. Each category has a link to an alternate view to return it's children.

Response codes:

Response Body is an Atom feed of categories or subcategories

Remote Login

The services/apps/remote/login/ endpoint [rovides access to remote login services on the application repository.

POST

Returns a session key, on successful login, to be used in subsequent requests to install remote applications.

Response codes:

Example

Log into SplunkBase:

curl -k -H "$SPLUNK_AUTH_HEADER" -X POST -d"username=SBuser&password=SBpass" "https://localhost:8089/services/apps/remote/login"

This returns an authToken that you have to URL encode using e.g.Python's urllib.quote():

<?xml version="1.0" encoding="UTF-8"?>

<response>
    <sessionKey>87ad615df536e3</sessionKey>
</response>