List subnets on the existing IP allow list for a feature.

Request parameters

Returned values

Example request and response

JSON Request

curl https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists

JSON Response

{
  "subnets": [
     ": #.0.0.0/24",
     ": #.0.0.0/24",
     ": #.0.10.6/32"
  ]
}

Add subnets to the IP allow list for a feature.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--data '{
"subnets": [
"###.0.0.0/24",
"##.0.10.6/32"
]
}'

JSON Response

{
"code": "200"
}

Delete subnets from the IP allow list for a feature

Request parameters

Returned values None

Example request and response

JSON Request

curl -X DELETE 'https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2Vj...' \
--header 'Content-Type: application/json' \
--data '{
"subnets": [
"###.0.0.0/24",
"##.0.10.6/32"
]
}'

JSON Response

{
"code": "200"
}

List existing outbound ports.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/access/outbound-ports' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

[
   {
       "destinationRanges": [
           "34.226.34.80/32",
           "54.226.34.80/32"
       ],
       "name": "8089",
       "port": 8089
   },
   {
       "destinationRanges": [
           "4.16.171.10/32"
       ],
       "name": "8590",
       "port": 8590
   }
]

Create an outbound port.

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/access/outbound-ports' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'  \
--data-raw '{
   "outboundPorts": [{"subnets": ["34.226.34.80/32", "54.226.34.80/32"], "port": 8089}],
   "reason": "testing federated search connection"
}'

JSON Response

{
   "outboundPorts": [
       {
           "port": 8089,
           "subnets": [
               "34.226.34.80/32",
               "54.226.34.80/32"
           ]
       }
   ],
   "reason": "testing federated search connection"

Describe an outbound port.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports/8089' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

{
   "destinationRanges": [
       "34.226.34.80/32",
       "54.226.34.80/32"
   ],
   "name": "8089",
   "port": 8089
}

Delete an outbound port.

Request parameters

Returned values

Example request and response

JSON Request

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/access/outbound-ports/8089' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--header 'Content-Type: application/json' \
--data-raw '{
"subnets": ["54.203.114.197/32", "34.226.34.80/32"]
}'

JSON Response

{
   "subnets": [
       "54.203.114.197/32",
       "34.226.34.80/32"
   ]
}

Export data from app/default, app/local, and user/app directories.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X GET 'https://admin.splunk.com/sh-i-xxx.test-export/adminconfig/v2/apps/victoria/export/download/search?local=true&default=false&users=true' \
--header 'Authorization: Bearer eyJraWQiOiJz...'
--output search.tar.gz

JSON Response

{
   search.tar.tgz
}

List read and write permissions assigned to roles for all apps.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps?count={{count}}&offset={{offset}}' \
--header 'Authorization: Bearer eyJraWQi0iJzcGX1...'

JSON Response

{
    "apps": [
        {
            "name": "app1",
            "perms": {
                "read": [
                    "*"
                ],
                "write": [
                    "*"
                ]
            }
        },
        {
            "name": "app2",
            "perms": {
                "read": [
                    "*"
                ],
                "write": [
                    "admin"
                ]
            }
        },
        {
            "name": "app3",
            "perms": {
                "read": [
                    "*"
                ],
                "write": [
                    "admin"
                ]
            }
        }
    ]
}

View read and write permissions assigned to roles for an individual app.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/permissions/apps/{app-name}' \
--header 'Authorization: Bearer eyJraWQi0iJzcGX1...'

JSON Response

{
    "name": "APP-NAME",
    "perms": {
        "read": [
            "admin",
            "power"
        ],
        "write": [
            "admin"
        ]
    }
}

Assign read and write permissions to roles for an individual app.

Request parameters

Returned values

Example request and response

JSON Request

curl -X PATCH 'https://admin.splunk.com/{stack}//adminconfig/v2/permissions/apps/{app_name}' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{token}}' \
--data '{
    "read": ["admin", "power"],
    "write": ["admin"]
} 
'

JSON Response

{
    "name": "acs_test_app_1",
    "perms": {
        "read": [
            "admin",
            "power"
        ],
        "write": [
            "admin"
        ]
    }
}

List existing self storage locations.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

{
    "selfStorageLocations": [
        {
            "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
            "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/dup-title-ui",
            "description": "Test dupilcate title from UI",
            "folder": "dup-title-ui",
            "title": "test-bucket-1-with-message",
            "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/dup-title-ui"
        },
        {
            "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
            "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder",
            "description": "Test",
            "folder": "some-folder",
            "title": "test-bucket-1-with-message",
            "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder"
        },
        {
            "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
            "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message",
            "description": "Test configuring ddss with ACS and show async message",
            "folder": "with-message",
            "title": "test-bucket-1-with-message",
            "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message"
        }
    ]
}

Configure self storage locations in AWS or GCP.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

For AWS S3:

{
    "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
    "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message",
    "description": "Test configuring ddss with ACS and show async message",
    "folder": "with-message",
    "title": "test-bucket-1-with-message",
    "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/with-message"
}

For GCP GCS:

{
    "bucketName": "indexes-acs-gcp-ic1l-bucket",
    "bucketPath": "indexes-acs-gcp-ic1l-bucket/untitled-folder",
    "description": "Test configuring ddss with ACS on GCP Stack",
    "folder": "untitled-folder",
    "title": "test-bucket-for-gcp",
    "uri": "gs://indexes-acs-gcp-ic1l-bucket/untitled-folder"
}

Describe a self storage location.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets/acs-play-noah-aws-iycf10l9z5nl-bucket-1%2Fsome-folder' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

For AWS deployments:'"

{
    "bucketName": "acs-play-noah-aws-iycf10l9z5nl-bucket-1",
    "bucketPath": "acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder",
    "description": "Test",
    "folder": "some-folder",
    "title": "test-bucket-1-with-message",
    "uri": "s3://acs-play-noah-aws-iycf10l9z5nl-bucket-1/some-folder"
}

For GCP deployments:'"

{
    "bucketName": "acs-play-noah-gcp-ic1l-bucket",
    "bucketPath": "acs-play-noah-gcp-ic1l-bucket/some-folder",
    "description": "Test",
    "folder": "some-folder",
    "title": "test-bucket-with-message",
    "uri": "gs://acs-play-noah-gcp-ic1l-bucket/some-folder"
}

Get prefix to configure a bucket.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/configs/prefix' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

{
    "message": "Please create a bucket in the same region as your Splunk Cloud environment. The bucket must have 'acs-play-noah-aws-iycf10l9z5nl-' as the prefix in the name",
    "prefix": "acs-play-noah-aws-iycf10l9z5nl-"
}

Get IAM policy for AWS S3 bucket.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/buckets/{bucketName}/policy' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

{
    "message": "Please copy and apply this bucket policy to your S3 bucket in AWS. Please refer to https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/DataSelfStorage for more info.",
    "policy": {
        "Statement": [
            {
                "Action": [
                    "s3:PutObject",
                    "s3:ListBucket"
                ],
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::594195655983:role/acs-play-noah-aws"
                },
                "Resource": [
                    "arn:aws:s3:::acs-play-noah-aws-iycf10l9z5nl-some-bucket",
                    "arn:aws:s3:::acs-play-noah-aws-iycf10l9z5nl-some-bucket/*"
                ]
            }
        ],
        "Version": "2012-10-17"
    }
}

Get service accounts for GCP GCS bucket.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/configs/service-accounts' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

{
    "message": "Please configure proper permissions for the GCP service accounts. Please refer to https://docs.splunk.com/Documentation/SplunkCloud/latest/Admin/DataSelfStorage for more info.",
    "serviceAccounts": {
        "clusterMaster": "indexes-acs-gcp-c0m1@indexes-acs-gcp-cdf8.iam.gserviceaccount.com",
        "indexer": "indexes-acs-gcp-idx@indexes-acs-gcp-cdf8.iam.gserviceaccount.com"
    }
}

View existing JWT tokens.

Request parameters

Returned values

Example request and response

JSON Request

curl -X GET 'https://admin.splunk.com/{stack}/adminconfig/v2/tokens/' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi...'

JSON Response

[
     {
          "id": "d9637736177efc773ec8c5c04efcc2e19859cd852af00689ef81bf9e809364a8",
          "user": "admin",
          "audience": "acs-test",
          "status": "enabled",
          "expiresOn": "2021-11-19T00:34:46Z",
          "notBefore": "2021-10-20T00:34:46Z",
          "lastUsed": "2021-10-20T03:52:53Z",
          "lastUsedIP": "50.216.96.2"
     },
     {
          "id": "a9637736177efc773ec8c5c04efcc2e19859cd852af00689ef81bf9e80936984",
          "user": "admin",
          "audience": "acs-test2",
          "status": "enabled",
          "expiresOn": "2022-05-19T00:34:46Z",
          "notBefore": "2022-04-20T00:34:46Z",
          "lastUsed": "2022-04-24T03:52:53Z",
          "lastUsedIP": "45.216.96.2"
     }
]

Create a new token.

Request parameters

Returned values

Example request and response

JSON Request

curl -u username:password -X POST 'https://admin.splunk.com/keziabutterfinger/adminconfig/v2/tokens' \
--header 'Content-Type: application/json' \
--data-raw '{
  "user" : "admin",
  "audience" : "acs-test",
  "expiresOn" : "+100d"
}'
}'

JSON Response

   "user": "admin",
   "audience": "acs-test",
   "id": "0c1daac93fd01bc50cfe8ed938ce401bc168a8730c1c9e2f343671541e759fbf",
   "token": "eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnIjoiSFM1MTIiLCJ2ZXIiOiJ2MiIsInR0eXAiOiJzdGF0aWMifQ.eyJpc3MiOiJhZG1pbiBmcm9tIHNoLWktMGJlMzJiYTM1YjY4MDlhMDEiLCJzdWIiOiJhZG1pbiIsImF1ZCI6Imtlei10ZXN0IiwiaWRwIjoiU3BsdW5rIiwianRpIjoiMzA0YmEzYWQxOWMwOWRhYmYxYzljY2YzYTcxMTM3NTQ1NmFiODM0ZDljMjBjN2E3MzYzNWUyYWMxNmQ5OWFiMSIsImlhdCI6MTYzNDA2NjAzMSwiZXhwIjoxNjM2NjU4MDMxLCJuYnIiOjE2MzQwNjYwMzF9.Cml1yQMXgo18dauOuORTc4vTxm1tWuXOL6sBj0TEV1lwOIqo5sCBKv_B45Jjb34XkK-TJQgdYqcOoV0un-ARDQ",
   "status": "enabled",
   "expiresOn": "2021-12-16T21:37:11Z",
   "notBefore": "2021-11-16T21:37:11Z"

View a token.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/tokens/55ee3d1c199645c330d28dcd9fa50bc6e9f74154c3d1c3d31229b6e78be77ed7' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

{
   "id": "d9637736177efc773ec8c5c04efcc2e19859cd852af00689ef81bf9e809364a8",
   "user": "admin",
   "audience": "acs-test",
   "status": "enabled",
   "expiresOn": "2021-11-19T00:34:46Z",
   "notBefore": "2021-10-20T00:34:46Z",
   "lastUsed": "2021-10-20T03:52:53Z",
   "lastUsedIP": "50.216.96.2"
}

Delete a token.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/tokens/55ee3d1c199645c330d28dcd9fa50bc6e9f74154c3d1c3d31229b6e78be77ed7' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

{
"code": "200"
}

List existing HEC tokens.

Request parameters

Returned values

Example request and response

JSON Request

curl https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors

JSON Response

{
   "http-event-collectors": [
       {
           "spec": {
               "allowedIndexes": [
                   "main",
                   "summary"
               ],
               "defaultHost": "",
               "defaultIndex": "main",
               "defaultSource": "",
               "defaultSourcetype": "",
               "disabled": true,
               "name": "hec-token-name",
               "useACK": true 
           },
           "token": "9803a48f-b733-4106-8a3f-871c53ee2675"
       }
   ]
}

Create a new HEC token.

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/mystack/adminconfig/v2/inputs/http-event-collectors' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--header 'Content-Type: application/json' \
--data-raw '{
   "allowedIndexes": [
       "main",
       "summary"
   ],
   "defaultHost": "",
   "defaultIndex": "main",
   "defaultSource": "",
   "defaultSourcetype": "",
   "disabled": false,
   "name": "hec-token-name",
   "useACK": true,
   "token": "this_is_my_token"
}'

JSON Response

"http-event-collector": {
       "spec": {
           "allowedIndexes": [
               "main",
               "summary"
           ],
           "defaultHost": "",
           "defaultIndex": "main",
           "defaultSource": "",
           "defaultSourcetype": "",
           "disabled": false,
           "name": "hec-token-name"
           "UseACK": true
       },
       "token": "this_is_my_token"
   }
}

View an inidvidual HEC token.

Request parameters

Returned values

Example request and response

JSON Request

curl https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors/{hec-token-name}

JSON Response

{
   "http-event-collectors": [
       {
           "spec": {
               "allowedIndexes": [
                   "main",
                   "summary"
               ],
               "defaultHost": "",
               "defaultIndex": "main",
               "defaultSource": "",
               "defaultSourcetype": "",
               "disabled": true,
               "name": "hec-token-name"
           },
           "token": "9803a48f-b733-4106-8a3f-871c53ee2675"
       }
   ]
}

Update an existing HEC token.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X PUT 'https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--header 'Content-Type: application/json' \
--data-raw '{
   "allowedIndexes": [
       "main",
       "summary"
   ],
   "defaultHost": "",
   "defaultIndex": "main",
   "defaultSource": "",
   "defaultSourcetype": "",
   "disabled": false,
   "name": "hec-token-name"
}'

JSON Response

{
"code": "200"
}

Delete an HEC token.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X DELETE 'https://admin.splunk.com/{mystack}/adminconfig/v2/inputs/http-event-collectors' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--header 'Content-Type: application/json' \

JSON Response

{
"code": "200"
}

List existing indexes.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/indexes'

JSON Response

[
   {
       "name": "history",
       "datatype": "event",
       "searchableDays": 7,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "lastchanceindex",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "main",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "splunklogger",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   },
   {
       "name": "summary",
       "datatype": "event",
       "searchableDays": 1095,
       "maxDataSizeMB": 0,
       "totalEventCount": "0",
       "totalRawSizeMB": "0"
   }
]

Create a new index.

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/indexes'
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' \
--header 'Content-Type: application/json' \
--data-raw '{
   "name": "testindex"
}'

JSON Response

{
   "name": "testindex",
   "datatype": "event",
   "searchableDays": 90,
   "maxDataSizeMB": 0,
   "totalEventCount": "0",
   "totalRawSizeMB": "0"
}

View an individual index.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/indexes/testindex' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

{
   "name": "testindex",
   "datatype": "event",
   "searchableDays": 90,
   "maxDataSizeMB": 1024,
   "totalEventCount": "0",
   "totalRawSizeMB": "0"
}

Update an existing index.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X PATCH 'https://admin.splunk.com/lighthearted-lemur-23e/adminconfig/v2/indexes/testindex' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' \
--data-raw '{
   "searchableDays": 90,
   "maxDataSizeMB": 1024
}'

JSON Response

{
   "name": "testindex",
   "datatype": "event",
   "searchableDays": 90,
   "maxDataSizeMB": 1024,
   "totalEventCount": "0",
   "totalRawSizeMB": "0"
}

Delete an index.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X DELETE 'https://admin.splunk.com/lighthearted-lemur-23e/adminconfig/v2/indexes/testindex' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…' 

JSON Response

{
"code": "200"
}

List all limits.conf settings.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

[{"Stanza":"join","Values":{"subsearch_maxout":"91519","subsearch_maxtime":"111","subsearch_timeout":"120"}},{"Stanza":"kv","Values":{"limit":"100","maxchars":"182"}},{"Stanza":"subsearch","Values":{"maxout":"10000","maxtime":"60"}}]

List limits.conf settings under a stanza.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

{"subsearch_maxout":"91519","subsearch_maxtime":"111","subsearch_timeout":"120"}

Edit limits.conf settings.

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "settings": {
        "subsearch_maxout": 91519,
        "subsearch_maxtime": 111
    }
}'

JSON Response

{"settings":{"subsearch_maxout":91519,"subsearch_maxtime":111}}

List a specific limits.conf setting under a stanza.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join/susearch_maxout \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

{"subsearch_maxout":"91519"}

List all supported limits.conf stanzas and default settings.

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/defaults \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

[
	{
		"stanza": "join",
		"settings": [
			{
				"setting": "subsearch_maxout",
				"minValue": 0,
				"maxValue": 100000,
				"defaultValue": 50000
			},
			{
				"setting": "subsearch_maxtime",
				"minValue": 0,
				"maxValue": 120,
				"defaultValue": 60
			},
			{
				"setting": "subsearch_timeout",
				"minValue": 0,
				"maxValue": 240,
				"defaultValue": 120
			}
		]
	},
    ...
]

List default values for settings in a specific limits.conf stanza

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/subsearch/defaults \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

{
	"stanza": "subsearch",
	"settings": [
		{
			"setting": "maxout",
			"minValue": 0,
			"maxValue": 10400,
			"defaultValue": 10000
		},
		{
			"setting": "maxtime",
			"minValue": 0,
			"maxValue": 120,
			"defaultValue": 60
		}
	]
}

Reset a specific setting or all settings under a stanza

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/important-iguana-u5q/adminconfig/v2/limits/join/reset' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

{"settings":{"subsearch_maxout":50000,"subsearch_maxtime":60,"subsearch_timeout":120}}

List maintenance window change freezes.

Request parameters

Returned values

Example request and response

JSON Request

curl -X GET 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/preferences' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

{
    "changeFreezes":{
        "customerInitiatedFreezes":[
            {
                "appliesTo":"Customer and Splunk Initiated Changes",
                "createdTimestamp":"2023-01-08T22:00:57Z",
                "endDate":"2023/02/14",
                "id":"b84a41c4-0344-48e5-8008-33ed44c2d393",
                "lastModifiedTimestamp":"2023-01-08T22:00:57Z",
                "reason":"Customer Business Needs",
                "startDate":"2023/02/01"
            }
        ],
        "splunkInitiatedFreezes":[
            {
                "appliesTo":"Customer and Splunk Initiated Changes",
                "category":"Professional Services",
                "createdTimestamp":"2023-01-08T22:00:57Z",
                "endDate":"2023/04/05",
                "id":"c5c122ee-78fc-4b4e-be6d-737396913abb",
                "lastModifiedTimestamp":"2023-01-08T22:00:57Z",
                "reason":"Professional Services Engagement",
                "startDate":"2023/04/01"
            }
        ]
    },
    "recordVersion":19
}

Update, create, delete maintenance window change freezes.

Request parameters

Returned values None

Example request and response: Update

JSON Request

curl -X PUT 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/preferences' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...' \
--data '{
	"changeFreezes": {
		"customerInitiatedFreezes": [
			{
				"startDate": "2024/06/28",
				"endDate": "2024/07/02",
				"id": "b84a41c4-0344-48e5-8008-33ed44c2d393",
				"appliesTo": "Splunk Initiated Changes Only",
				"reason": "End of Quarter Freeze"
			},
			{
				"startDate": "2024/09/01",
				"endDate": "2024/09/14",
				"id": "3200242e-afc8-41dd-acd4-13ef41b5f3fd",
				"appliesTo": "Customer and Splunk Initiated Changes",
				"reason": "Business Needs"
			},
		]
	},
	"recordVersion": 2
}'

JSON Response

<empty>

Example request: Create

JSON Request

curl -X PUT 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/preferences' \
--header "Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI..."
--data '{
	"changeFreezes": {
		"customerInitiatedFreezes": [
			{
				"startDate": "2024/06/28",
				"endDate": "2024/07/02",
				"appliesTo": "Splunk Initiated Changes Only",
				"reason": "End of Quarter Freeze"
			},
		]
	},
	"recordVersion": 1
}'

Example request: Delete

curl -X PUT 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/preferences' \
--header "Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI..."
--data '{
	"changeFreezes": {
		"customerInitiatedFreezes": [],
	},
	"recordVersion": 2
}'

List multiple scheduled maintenance windows.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules?fromTime=2022-08-09&toTime=2022-08-14&nextLink=2022-08-21T04:00:00Z&count=1' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsu …'

JSON Response

{
   "nextLink": "2024-08-21T04:00:00Z",
   "schedules": [
       {
           "duration": "2h",
           "lastModifiedTimestamp": "2024-06-20T04:00:00Z",
           "lastSummary": "Customer requested an upgrade",
           "mwType": "Service Update Maintenance",
           "operations": [
               {
                   "SFDCTickets": ["SFDC-1234"],
                   "endTime": "2024-08-21T06:00:00Z",
                   "notes": ["Updating the stack to the latest version."],
                   "operationDescription": "KitKat Tock Upgradtez",
                   "operationStatus": "Tentative",
                   "startTime": "2024-08-21T04:00:00Z",
                   "zeroDowntime": true
               }
           ],
           "requestedEntity": "splunk",
           "scheduleEndTimestamp": "2024-08-21T06:00:00Z",
           "scheduleId": "1e4729b4-11d0-4165-a886-a21cce7139f2",
           "scheduleStartTimestamp": "2024-08-21T04:00:00Z",
           "status": "Tentative",
           "zeroDowntime": true 
       }
   ]
}

Describe a specific scheduled maintenance window.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsu …'

JSON Response

{
    "duration": "2h",
    "lastModifiedTimestamp": "2024-06-20T04:00:00Z",
    "lastSummary": "Customer requested an upgrade",
    "mwType": "Service Update Maintenance",
    "operations": [
        {
            "SFDCTickets": ["SFDC-1234"],
            "endTime": "2024-08-21T06:00:00Z",
            "notes": ["Updating the stack to the latest version."],
            "operationDescription": "KitKat Tock Upgradtez",
            "operationStatus": "Tentative",
            "startTime": "2024-08-21T04:00:00Z",
            "zeroDowntime": true
        }
    ],
    "requestedEntity": "splunk",
    "scheduleEndTimestamp": "2024-08-21T06:00:00Z",
    "scheduleId": "1e4729b4-11d0-4165-a886-a21cce7139f2",
    "scheduleStartTimestamp": "2024-08-21T04:00:00Z",
    "status": "Tentative",
    "zeroDowntime": true
}

View audit trail of a specified maintenance window.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/maintenance-windows/schedules/{scheduleId}/audits?fromTime=2022-08-09&toTime=2022-08-14' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsu …'

JSON Response

{
    "audits": [
        {
            "duration": "2h",
            "lastModifiedTimestamp": "2024-06-20T04:00:00Z",
            "lastSummary": "Customer requested an upgrade",
            "mwType": "Service Update Maintenance",
            "operations": [
                {
                    "SFDCTickets": ["SFDC-1234"],
                    "endTime": "2024-08-21T06:00:00Z",
                    "notes": ["Updating the stack to the latest version."],
                    "operationDescription": "KitKat Tock Upgrade",
                    "operationStatus": "Tentative",
                    "startTime": "2024-08-21T04:00:00Z",
                    "zeroDowntime": true
                }
            ],
            "requestedEntity": "splunk",
            "scheduleId": "1e4729b4-11d0-4165-a886-a21cce7139f2",
            "scheduleStartTimestamp": "2024-08-21T04:00:00Z",
            "status": "Tentative",
            "zeroDowntime": true
        },
        {
            "duration": "2h",
            "lastModifiedTimestamp": "2024-06-22T08:00:00Z",
            "lastSummary": "Customer requested an upgrade",
            "mwType": "Service Update Maintenance",
            "operations": [
                {
                    "SFDCTickets": ["SFDC-1234"],
                    "endTime": "2024-08-21T06:00:00Z",
                    "notes": ["Updating the stack to the latest version."],
                    "operationDescription": "KitKat Tock Upgrade",
                    "operationStatus": "Scheduled",
                    "startTime": "2024-08-21T04:00:00Z",
                    "zeroDowntime": true
                }
            ],
            "requestedEntity": "splunk",
            "scheduleEndTimestamp": "2024-08-21T06:00:00Z",
            "scheduleId": "1e4729b4-11d0-4165-a886-a21cce7139f2",
            "scheduleStartTimestamp": "2024-08-21T04:00:00Z",
            "status": "Tentative",
            "zeroDowntime": true
        }
    ]
}

List apps.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria'
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…'

JSON Response

{
   "apps": [
       {
           "label": "075-cloudworks",
           "name": "075-cloudworks",
           "status": "installed",
           "version": ""
       },
       {
           "label": "100-cloudworks-wlm",
           "name": "100-cloudworks-wlm",
           "status": "installed",
           "version": ""
       },


       {
           "label": "tos",
           "name": "tos",
           "status": "installed",
           "version": ""
       }
   ]
}

Install an app.

Request parameters

Returned values

Example request and response (install private app)

JSON Request

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria' \
--header 'X-Splunk-Authorization: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9…' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-binary '@/Users/croth/Downloads/pa1v20.tar.gz'

JSON Response

{
   "label": "pa1",
   "name": "pa1",
   "status": "installed",
   "version": "1.2.2"
}

Example request and response (install Splunkbase app)

JSON Request

curl -X POST 'https:/admin.splunk.com/{stack}/adminconfig/v2/apps/victoria?splunkbase=true' \
--header 'X-Splunkbase-Authorization: bgf4ztyxcgssgcbdrhguzl0xgousxzcq' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'ACS-Licensing-Ack: http://opensource.org/licenses/ISC' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-urlencode 'splunkbaseID=491'

JSON Response

{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.4"
}

Describe an app.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

{
   "label": "testapp",
   "name": "testapp",
   "status": "installed",
   "version": ""
}

Upgrade or downgrade a Splunkbase app.

Request parameters

Returned values

Example request and response

JSON Request

curl -X PATCH 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/SplunkforPaloAltoNetworks' \
--header X-Splunkbase-Authorization: bgf4ztyxcgssgcbdrhguzl0xgousxzcq' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'ACS-Licensing-Ack: http://opensource.org/licenses/ISC' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-urlencode 'version=7.0.3'

JSON Response

{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.3"
}

Uninstall an app.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response None

List apps.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps?count=100' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…'

JSON Response

{
   "apps": []
}

Install an app.

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/apps' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--form 'token="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9…"' \
--form 'package=@"/Users/{name}/app_inspect/testapp.tar.gz"'

JSON Response

{
   "label": "testapp",
   "name": "testapp",
   "package": "testapp.tar.gz",
   "status": "installed",
   "version": "1.0.31"
}

Describe an app.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/victoria/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

JSON Response

{
   "label": "testapp",
   "name": "testapp",
   "package": "testapp.tar.gz",
   "status": "installed",
   "version": ""
}

Upgrade a Splunkbase app.

Request parameters

Returned values

Example request and response

JSON Request

curl -X PATCH 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/SplunkforPaloAltoNetworks' \
--header X-Splunkbase-Authorization: bgf4ztyxcgssgcbdrhguzl0xgousxzcq' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'ACS-Licensing-Ack: http://opensource.org/licenses/ISC' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--data-urlencode 'splunkbaseID=491'

JSON Response

{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.3"
}

Uninstall an app.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X DELETE 'https://admin.splunk.com/{stack}/adminconfig/v2/apps/testapp' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…'

JSON Response

{
"code": "200"
}

Check Python runtime version.

Request parameters

Returned values

Example request and response

JSON Request

curl 'https://admin.splunk.com/{stack-name}/adminconfig/v2/python-runtime' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI...'

JSON Response

{
  "pythonRuntime": "force_python3"
}

Change Python runtime version.

Request parameters

Returned values None

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/{stack-name}/adminconfig/v2/python-runtime' \
   --header 'Authorization: Bearer eyJraWQ...' \
   -H "Content-Type: application/json" \
   --data '{
                "pythonVersion" : "unset"
        }'

JSON Response

{
  "message": "pythonVersion rolled back to python2"
}

Initiate a restart of a single search head or a rolling restart of a search head cluster.

None

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/restart-now' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...'

JSON Response

{
    "message": "Successfully initiated a server restart. It might take some time for completion"
}

Check status of search head cluster rolling restart.

Example request and response

JSON Request

curl https://admin.splunk.com/{stack}/adminconfig/v2/restart/status \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...

JSON Response

{
    "shcStatus": [
{
	   "captain": "sh-i-..",
        "rollingRestartInitiated": true,
        "serviceReady": false
     }
   ]

View legal disclaimer.

Request parameters

Returned values None

Example request and response

JSON Request

curl "https://admin.splunk.com/{stack}/adminconfig/v2/emek/waiver" \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

Sample Response

AWS Legal Disclaimer

Thank you for subscribing to an encryption service for data at rest as an add-on to the Splunk Cloud Platform service. As you know, Splunk Cloud Platform relies on AWS Cloud Key Management Service (Cloud KMS) for key management operations, and customers who elect to use the Enterprise Managed Encryption Key (EMEK) capability assume full control of the customer master key (CMK) in Cloud KMS. Before electing to directly manage your own master in Cloud KMS, please reply to this message to confirm and acknowledge the following risks and responsibilities involved with self-management of your CMK:  

    * You are assuming ownership and full responsibility for the integrity and ongoing availability of your CMK in Cloud KMS.

    * The CMK is required for encrypting and decrypting Splunk data in real-time.

    * Loss of access to the CMK in Cloud KMS can and will result in service interruption and/or permanent loss of data access by all parties (AWS, Splunk and you).

    * Unauthorized access to the CMK in Cloud KMS can result in accidental or explicit key operations (such as key deactivation and/or deletion) that could lead to service disruption and/or permanent loss of data access by all parties (AWS, Splunk and you).

    * You must maintain Splunk privileged access to the CMK via Splunk mandated key policy definitions.

GCP Legal Disclaimer

Thank you for subscribing to an encryption service for data at rest as an add-on to the Splunk Cloud Platform service. As you know, Splunk Cloud Platform relies on GCP Cloud Key Management Service (Cloud KMS) for key management operations, and customers who elect to use the Enterprise Managed Encryption Key (EMEK) capability assume full control of the customer master key (CMK) in Cloud KMS. Before electing to directly manage your own master in Cloud KMS, please reply to this message to confirm and acknowledge the following risks and responsibilities involved with self-management of your CMK:  

    * You are assuming ownership and full responsibility for the integrity and ongoing availability of your CMK in Cloud KMS.

    * The CMK is required for encrypting and decrypting Splunk data in real-time.

    * Loss of access to the CMK in Cloud KMS can and will result in service interruption and/or permanent loss of data access by all parties (GCP, Splunk and you).

    * Unauthorized access to the CMK in Cloud KMS can result in accidental or explicit key operations (such as key deactivation and/or deletion) that could lead to service disruption and/or permanent loss of data access by all parties (GCP, Splunk and you).

    * You must maintain Splunk privileged access to the CMK via Splunk mandated key policy definitions.

Get KMS key policy

Request parameters

Returned values

Example request and response

JSON Request

curl "https://admin.splunk.com/{stack}/adminconfig/v2/emek/key-policy" \
--header 'EMEK-Legal-Ack: Y' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'

AWS sample response

{
    "message": "Please copy and apply this key policy in AWS. Make sure to replace ${CUSTOMER_ACCOUNT_ID} with your corresponding AWS account ID.",
    "policy": {
        "Id": "key-consolepolicy-3",
        "Statement": [
            {
                "Action": "kms:*",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::${CUSTOMER_ACCOUNT_ID}:root"
                },
                "Resource": "*",
                "Sid": "Enable IAM User Permissions"
            },
            {
                "Action": [
                    "kms:Encrypt",
                    "kms:Decrypt",
                    "kms:ReEncrypt*",
                    "kms:GenerateDataKey*",
                    "kms:DescribeKey"
                ],
                "Condition": {
                    "ArnEquals": {
                        "aws:PrincipalArn": "arn:aws:iam::992171771154:role/test-ibaniya-emek"
                    }
                },
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::992171771154:root"
                },
                "Resource": "*",
                "Sid": "Allow SplunkCloud to use the KMS Key"
            },
            {
                "Action": [
                    "kms:Encrypt",
                    "kms:GenerateDataKey*",
                    "kms:ReEncrypt*",
                    "kms:DescribeKey"
                ],
                "Condition": {
                    "ArnEquals": {
                        "aws:PrincipalArn": "arn:aws:iam::992171771154:role/terraform_assumed_role-lve"
                    }
                },
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::992171771154:root"
                },
                "Resource": "*",
                "Sid": "Allow SplunkCloud's Infrastructure Builder to use Key"
            },
            {
                "Action": [
                    "kms:CreateGrant",
                    "kms:ListGrants",
                    "kms:RevokeGrant"
                ],
                "Condition": {
                    "Bool": {
                        "kms:GrantIsForAWSResource": "true"
                    }
                },
                "Effect": "Allow",
                "Principal": {
                    "AWS": [
                        "arn:aws:iam::992171771154:root"
                    ]
                },
                "Resource": "*",
                "Sid": "Allow attachment of persistent resources"
            }
        ],
        "Version": "2012-10-17"
    },
    "region": "us-east-1"
}

GCP sample response:

{
    "message": "Create a KMS key in the following GCP region: us-central1. Apply the provided Splunk Cloud cross-account key policy template, see Using Key Policies and Allowing Cross-Account access to a CMK for more details on this. Make sure to replace any placeholder values if applicable. Once the above steps have been completed, please provide Splunk Cloud with the ARN of the KMS key created as well as the output of the KMS describe key command.",
    "policy": {
        "bindings": [
            {
                "members": [
                    "serviceAccount:test-ibaniya-gcp-idx@test-ibaniya-gcp-9fe6.iam.gserviceaccount.com",
                    "serviceAccount:service-945453386874@compute-system.iam.gserviceaccount.com"
                ],
                "role": "roles/cloudkms.cryptoKeyEncrypterDecrypter"
            },
            {
                "members": [
                    "serviceAccount:lve-stack-tf@cworks-lve-dd28.iam.gserviceaccount.com",
                    "serviceAccount:test-ibaniya-gcp-idx@test-ibaniya-gcp-9fe6.iam.gserviceaccount.com"
                ],
                "role": "roles/cloudkms.viewer"
            }
        ]
    },
    "region": "us-central1"
}

Upload KMS key

Request parameters

Returned values NONE

Example request and response

JSON Request

curl -X PUT "https://admin.splunk.com/{stack}/adminconfig/v2/emek/key" \
--header 'EMEK-Legal-Ack: Y' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'
--data '{
    "keyARN": "arn:aws:kms:us-east-1:111111111111:key/000000-xxx"
}'

Sample Response

{
    "message": "EMEK Key ARN upload request accepted. To check the status of your request, use DescribeStack operation. Please contact Splunk support to use this EMEK key to re-key your stack."
}

Check the status of the latest operation in Splunk Cloud Platform

Request parameters

Returned values

Example request and response

JSON Request

curl https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...

JSON Response

{
   "lastDeployment": {
       "id": "AD11DDF4-B13B-4EDC-9B4F-A5FF539CD196",
       "timestamp": "6/16/2023, 11:31:22 AM",
       "status": "failed"
   }
}

Retry a failed private app installation or HEC token management operation.

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/deployment/retry' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1...'

JSON Response

{
   "id": "30D3BC03-11AC-4A16-88F7-7924735638ED",
   "timestamp": "6/16/2023, 11:31:22 AM",
   "status": "new"
}

Check the status of a retry or other operation by deployment ID in Splunk Cloud Platform.

Request parameters

Returned values

Example request and response

JSON Request

curl https://admin.splunk.com/{stack}/adminconfig/v2/deployment/status/{deploymentID} \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYW...

JSON Response

{
   "lastDeployment": {
       "id": "AD11DDF4-B13B-4EDC-9B4F-A5FF539CD196",
       "timestamp": "6/16/2023, 11:31:22 AM",
       "status": "running"
   }
}

Pair your Observability organization with your Splunk Cloud stack.

Request parameters

Returned values

Example request and response

JSON Request

curl -X POST 'https://admin.splunk.com/<enter-stack-name>/adminconfig/v2/observability/sso-pairing' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI
...' \
--header 'o11y-access-token': 'xyz123...'

JSON Response

{
   "id": "a12b23cd"
}

Get the pairing status of a Splunk Observability Cloud organization and Splunk Cloud Platform stack.

Request parameters

Returned values

Example request and response

JSON Request

curl --location --request GET 'https://admin.splunk.com/{stack}/adminconfig/v2/observability/sso-pairing/a12b23cd' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer  eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI
...'
--header 'o11y-access-token': 'xyz123...'

JSON Response

{
   "pairingId":"a12b23cd",
   "status":"SUCCESS"
}