Cluster endpoint descriptions - Splunk Documentation (original) (raw)

Manage indexer clusters and search head clusters in Splunk Enterprise.

To distinguish indexer cluster endpoints from search cluster endpoints, note:

• Indexer cluster endpoints: Endpoints that contain cluster in their URIs pertain to indexer clusters.
• Search head cluster endpoints: Endpoints that contain shcluster in their URIs pertain to search head clusters.

The values manager and peer replace the prior values of master and slave. The prior values are currently still supported, but they will be removed from the product in a future release.

Usage details

Review ACL information for an endpoint

To check Access Control List (ACL) properties for an endpoint, append /acl to the path. For more information see Access Control List in the REST API User Manual.

Username and password authentication is required for access to endpoints and REST operations.

Splunk users must have role and/or capability-based authorization to use REST endpoints. Users with an administrative role, such as admin, can access authorization information in Splunk Web. To view the roles assigned to a user, select Settings > Access controls and click Users. To determine the capabilities assigned to a role, select Settings > Access controls and click Roles.

App and user context

Typically, knowledge objects, such as saved searches or event types, have an app/user context that is the namespace. For more information about specifying a namespace, see Namespace in the REST API User Manual.

Splunk Cloud Platform limitations

As a Splunk Cloud Platform user, you are restricted to interacting with the search tier only with the REST API. Cluster endpoints are generally not accessible in Splunk Cloud Platform.

Authorized users can access and configure other indexer cluster nodes, including indexer or cluster manager, or license manager nodes, in the Splunk Cloud Platform manager user interface.

See Access requirements and limitations for the Splunk Cloud Platform REST API in the the REST API Tutorials manual for more information.

Indexer cluster endpoints

The endpoints in this section pertain to indexer clusters.

All endpoints that contain cluster in their URIs pertain to indexer clusters. In this section, if a URI contains the term search head, it refers to search head nodes in the indexer cluster. The term peer node refers to peer nodes in the indexer cluster. For more information about indexer cluster architecture, see The basics of indexer cluster architecture and Search head configuration overview in the Managing Indexers and Clusters of Indexers manual.

cluster/config

https://:/services/cluster/config

Access cluster node configuration details.

GET

List cluster node configuration.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/config

XML Response

cluster/config/config

https://:/services/cluster/config/config

Manage cluster node configuration details.

GET

List cluster node configuration.

This operation works identically to the GET on cluster/config.

POST

Manage configuration details.

See Indexer cluster configuration overview in Managing Indexers and Clusters of Indexers and the [clustering] stanza options in the server.conf spec file for more details on indexer cluster configuration.

Request parameters

Response data keys

None.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/config/config -d cxn_timeout=59

XML Response

cluster/manager/buckets

https://:/services/cluster/manager/buckets

Provides bucket configuration information for a cluster manager node.

GET

List cluster manager node bucket configuration.

Request parameters
Use an &summaries=true field in the query string to show summaries.

Use one or more filters in the query string to select buckets or bucket states. For example, use this URL to filter buckets returned for both the main index and StreamingSource status.

https://localhost:8089/services/cluster/manager/buckets?filter=index=main&filter=status=StreamingSource

See the following table for available filters.

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/buckets

XML Response

cluster/manager/buckets/{name}

https://:/services/cluster/manager/buckets/{name}

Access bucket configuration information.

GET

List bucket configuration information.

Request parameters

The filter parameter of the Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/buckets/internal~1~238C3311-F0A4-4A9B-97F0-53667CFFEEAB

XML Response

cluster/manager/buckets/{bucket_id}/fix

https://:/services/cluster/manager/buckets/{bucket_id}/fix

Add the specified bucket to the fix list.

For more information, see Bucket-fixing scenarios in Managing Indexers and Clusters of Indexers.

Authentication and Authorization
Requires the admin role or indexes_edit capability.

POST

Add this bucket to the fix list.

Request parameters

None

Returned values
None

Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/cluster/manager/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/fix -X POST

XML Response

cluster/manager/buckets/{bucket_id}/fix_corrupt_bucket

https://:/services/cluster/manager/buckets/{bucket_id}/fix_corrupt_bucket

Trigger a corruption fixup of a clustered non-SmartStore-enabled bucket.

For more information, see Bucket-fixing scenarios in Managing Indexers and Clusters of Indexers.

Authentication and Authorization
Requires the admin role or edit_indexer_cluster capability.

POST

Trigger a corruption fixup for this bucket.

Request parameters

None

Returned values
None

Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/cluster/manager/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/fix_corrupt_bucket -X POST

XML Response

"links":{ "create":"/services/cluster/manager/buckets/_new" }, "origin":"https://chieftain:15511/services/cluster/manager/buckets", "updated":"2023-09-06T22:30:08-07:00", "generator":{ "build":"479782058d4faa7ef3404e947f4117df3a59654c", "version":"20230905" }, "entry":[

], "paging":{ "total":0, "perPage":30, "offset":0 }, "messages":[

]

cluster/manager/buckets/{bucket_id}/freeze

https://:/services/cluster/manager/buckets/{bucket_id}/freeze

Set the bucket's state to frozen. The frozen state may not persist after a cluster manager restart unless one of the peers has set the frozen state. A POST to this endpoint does not set the bucket's state to frozen on peers.

Note: Use this endpoint with caution. It is recommended to test the endpoint in a test cluster prior to use on an actual bucket.

For more information, see How the cluster handles frozen buckets in Managing Indexers and Clusters of Indexers.

Authentication and Authorization

Requires the admin role or indexes_edit capability.

POST

Set this bucket's state to frozen.

Request parameters
None

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/freeze -X POST

XML Response

cluster/manager/buckets/{bucket_id}/remove_all

https://:/services/cluster/manager/buckets/{bucket_id}/remove_all

Delete all copies of the specified bucket.

Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test cluster prior to use on an actual bucket.

Authentication and Authorization
Requires the admin role or indexes_edit capability.

POST

Delete all copies of the specified bucket.

Request parameters

None

Returned values

None. If an invalid bucket id is used, an error message is returned.

If the request is made on a hot bucket, an error message is returned.

Example request and response

XML Request

curl -k -u admin:password https://localhost:8089/services/cluster/manager/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/remove_all -X POST

XML Response

cluster/manager/buckets/{bucket_id}/remove_from_peer

https://:/services/cluster/manager/buckets/{bucket_id}/remove_from_peer

Deletes the copy of this bucket from specified peer.

If the request causes the cluster to lose its complete state, the cluster will engage in fixup activities. This may result in another copy of the same bucket appearing on this peer. If, however, the specified bucket is frozen, the cluster does not attempt any fixup activities.

Caution: Using this endpoint will cause irreversible data loss. It is recommended to test the endpoint on a test-cluster prior to use on an actual bucket.

Authentication and Authorization
Requires the admin role or indexes_edit capability.

POST

Delete this bucket from specified peer. Set bucket state to frozen

Request parameters

Returned values
None. If the peer parameter is missing from the request, an error message is returned.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/buckets/_internal~0~111175BA-00DF-4CFE-9AEC-48A87B97EC71/remove_from_peer -X POST -d peer=222275BA-00DF-4CFE-9AEC-48A87B97EC71

XML Response

cluster/manager/control/control/prune_index

https://:/services/cluster/manager/control/control/prune_index

Clean up excess bucket copies across an index.

For more information, see Remove extra bucket copies in Managing Indexers and Clusters of Indexers.

POST

Clean up excess bucket copies across an index.

Request parameters

Returned values
None

Example request

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/control/control/prune_index -d index="my_index"

cluster/manager/control/control/rebalance_primaries

https://:/services/cluster/manager/control/control/rebalance_primaries

Rebalance primary bucket copies across peers. For more information, see Rebalance the indexer cluster primary buckets in Managing Indexers and Clusters of Indexers.

POST

Rebalance primary buckets across all peers of this manager.

Request parameters

None

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/control/control/rebalance_primaries --request POST

XML Response

cluster/manager/control/control/remove_peers

https://:/services/cluster/manager/control/control/remove_peers

Remove one or more peers.

See also
cluster/manager/peers

POST

Remove one or more peers.

Request parameters

Returned values
None

Application usage

If peer status is not Down or GracefulShutdown, the interface returns the following error message:

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/control/control/remove_peers --request POST -d "peers=F2AA19BD-622F-4F8C-A8E0-1233"

XML Response

cluster/manager/control/control/resync_bucket_from_peer

https://:/services/cluster/manager/control/control/resync_bucket_from_peer

This endpoint resets the state of a specified bucket based on the current state of the bucket at a peer.

POST

Reset bucket state based on the current state of the bucket at a peer.

Request Parameters

| Name | Type | Default | Description | | | ------------ | ------ | ------- | ----------------------------------------------------------- | | | bucket_id | String | N/A | Required. ID of bucket to update. | | | peer | GUID | N/A | Required. GUID of peer from which to update the bucket. | |

Returned Values
None.

Example request and response

XML Request

curl -k -u admin:pass https://hostname:mPort:/services/cluster/manager/control/control/resync_bucket_from_peer -X POST -d bucket_id=_audit28F6747E9-88C9-4488-8806-4EA3CA433CF5 -d peer=8F6747E9-88C9-4488-8806-4EA3CA433CF5

XML Response

cluster/manager/control/control/roll-hot-buckets

https://:/services/cluster/manager/control/control/roll-hot-buckets

This endpoint forces a specified bucket in an indexer cluster to roll from hot to warm. Pass the bucket id (bid) to the manager node. The manager instructs the origin peer for that bucket to roll its copy. In turn, the origin peer tells all the replicating peers to roll their copies

You might discover a bucket that is stuck in fixup and needs to be rolled using logs, Splunk Web, or either of the following two endpoints.

• cluster/manager/fixup
• cluster/manager/buckets

Authorization and authentication
This endpoint requires the admin role for use.

POST

Force a bucket to roll from hot to warm.

Request parameters

Returned values
None.

Example request and response

XML Request

curl -k -u username:password https://localhost:8089/services/cluster/manager/control/control/roll-hot-buckets -X POST -d "bucket_id=_audit21A3889D7-954B-4CE6-B071-01B438DE9865"

XML Response

cluster/manager/control/control/rolling_upgrade_finalize

https://:/services/cluster/manager/control/control/rolling_upgrade_finalize

Finalizes an indexer cluster rolling upgrade.

POST

Finalizes an indexer cluster rolling upgrade.

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/control/control/rolling_upgrade_finalize -X POST

XML Response

cluster/manager/control/control/rolling_upgrade_init

https://:/services/cluster/manager/control/control/rolling_upgrade_init

Initializes an indexer cluster rolling upgrade.

POST

Initializes an indexer cluster rolling upgrade.

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/control/control/rolling_upgrade_init -X POST

XML Response

cluster/manager/control/default/abort_restart

https://:/services/cluster/manager/control/default/abort_restart

Aborts an ongoing restart of an indexer cluster.

Authentication and Authorization

Requires the admin role or edit_indexer_cluster capability.

POST

Abort an ongoing restart of an indexer cluster.

Request parameters
None

Returned values
None

Example request and response

JSON Request

curl -k -u admin:password -X POST "https://chieftain:15511/services/cluster/manager/control/default/abort_restart?output_mode=json"

JSON Response

{ "links":{

}, "origin":"https://chieftain:15511/services/cluster/manager/control", "updated":"2023-09-06T23:45:53-07:00", "generator":{ "build":"479782058d4faa7ef3404e947f4117df3a59654c", "version":"20230905" }, "entry":[

], "paging":{ "total":0, "perPage":30, "offset":0 }, "messages":[ { "type":"INFO", "text":"Aborting the rolling restart initiated successfully. List of peers skipped restarting: E30CA8C0-23E5-4A6B-9F28-D2EC991CCD75,9E3FED8B-59A0-4B95-8116-F8F8A67A7686,32790C7F-82CB-4E39-8689-3600F72D4D01,2B6C57ED-9FFC-44F0-9E58-CD8BE3519F3F,5A65CEB6-79A6-40D7-914C-4859DEACF79B,8C2DC775-EB8E-44D7-AFF8-38482B3A9990,033085C7-F31B-467D-9577-B8A5E5131810" } ] }

cluster/manager/control/default/apply

https://:/services/cluster/manager/control/default/apply

Pushes a bundle.

POST

Push a bundle.

Request Parameters

Returned Values
None.

Example request and response

XML Request

curl -k -u admin:pass https://host:mPort/services/cluster/manager/control/default/apply -X POST

XML Response

cluster/manager/control/default/cancel_bundle_push

https://:/services/cluster/manager/control/default/cancel_bundle_push

Cancels and resets the bundle push operation. Use this endpoint when the cluster manager does not receive a validation response from the cluster peer due to an error. For more information, see Configuration bundle issues.

POST

Cancel and reset the bundle push operation.

Request Parameters
None.

Returned Values
None.

Example request and response

XML Request

curl -k -u admin:pass https://host:mPort/services/cluster/manager/control/default/cancel_bundle_push -X POST

XML Response

cluster/manager/control/default/maintenance

https://:/services/cluster/manager/control/default/maintenance

Put the cluster manager into maintenance mode.

POST

Toggle maintenance mode.

Request Parameters

Returned Values
None.

Example request and response

XML Request

curl -k -u username:pass https://:/services/cluster/manager/control/default/maintenance -d mode=true

XML Response

cluster/manager/control/default/rollback

https://:/services/cluster/manager/control/default/rollback

Roll a bundle back to the previously active bundle.

POST

Roll back a bundle.

Request Parameters
None.

Returned Values
None.

Example request and response

XML Request

curl -k -u admin:pass https://host:mPort/services/cluster/manager/control/default/rollback -X POST

XML Response

cluster/manager/control/default/validate_bundle

https://:/services/cluster/manager/control/default/validate_bundle

Tests if the bundle in etc/manager-apps passes validation. Optionally, tests if the bundle will trigger an indexer restart.

POST

Validate a bundle.

Request Parameters

Returned Values
None.

Example request and response

XML Request

curl -k -u admin:pass https://host:mPort/services/cluster/manager/control/default/validate_bundle -d check-restart=true -X POST

XML Response

cluster/manager/fixup

https://:/services/cluster/manager/fixup

Access a list of buckets on a specific fixup priority level. Bucket fixups are processed in order of priority level. See Request parameters below for priority level details.

When you access a particular fixup level, buckets may appear in it even though they do not need fixup at this level. Initially, each bucket requiring fixup is added to all levels, even though it might only require processing in a subset of all levels. As the bucket is processed through a level, it is deleted from that level.

GET

List buckets on the specified fixup level.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
For each bucket in the specified fixup level, the response includes the following details for the initial time when the bucket went into the fixup level and the latest time that the bucket was checked.

Example request and response

XML Request

curl -k -u admin:password https://localhost:8089/services/cluster/manager/fixup?level=replication_factor

XML Response

cluster/manager/generation

https://:/services/cluster/manager/generation

Access current generation cluster manager information and create a cluster generation.

GET

List peer nodes participating in the current generation for this manager.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/generation

XML Response

POST

Create a cluster generation.

Request parameters

Returned values

Example request and response
XML Request

curl -k -u admin:pass https://myserver:8089/services/cluster/manager/generation -d name=foo

XML Response

cluster/manager/generation/{name}

https://:/services/cluster/manager/generation/{name}

Access information about a peer node participating in the current generation for the specified search head GUID.

GET

List peer node information of the specified search head GUID.

Request parameters

None

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/generation/manager

XML Response

POST

Create a new generation for the specified search head GUID.

Request parameters

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://myserver:8089/services/cluster/manager/generation/foo -X POST -d generation_poll_interval=62 -d label=PEER2

XML Response

cluster/manager/ha_active_status

https://:/services/cluster/manager/ha_active_status

Used by the load balancers to check the high availability mode of a given cluster manager.

The active cluster manager will return "HTTP 200", denoting "healthy", and a startup or standby cluster manager will return "HTTP 503".

Authentication and authorization
This endpoint is unauthenticated because some load balancers don't support authentication on a health check endpoint.

GET

Checks the high availability mode of a given cluster manager.

Request parameters

None

Returned values

None

Example request and response

Request

curl -k -v -u admin:changeme https://mrt:15511/services/cluster/manager/ha_active_status

Response

From active cluster manager:

< HTTP/1.1 200 OK < Date: Tue, 10 May 2022 10:45:57 GMT < Expires: Thu, 26 Oct 1978 00:00:00 GMT < Cache-Control: no-store, no-cache, must-revalidate, max-age=0 < Content-Type: text/xml; charset=UTF-8 < X-Content-Type-Options: nosniff < Content-Length: 1740 < Connection: Keep-Alive < X-Frame-Options: SAMEORIGIN < Server: Splunkd <

From standby cluster manager:

< HTTP/1.1 503 Service Unavailable < Date: Tue, 10 May 2022 10:47:00 GMT < Expires: Thu, 26 Oct 1978 00:00:00 GMT < Cache-Control: no-store, no-cache, must-revalidate, max-age=0 < Content-Type: text/xml; charset=UTF-8 < X-Content-Type-Options: nosniff < Content-Length: 154 < Connection: Keep-Alive < X-Frame-Options: SAMEORIGIN < Server: Splunkd < Cluster manager is in inactive mode.

cluster/manager/health

https://:/services/cluster/manager/health

Performs health checks to determine the cluster health and search impact, prior to a rolling upgrade of the indexer cluster.

Authentication and Authorization

Requires the admin role or list_indexer_cluster capability.

GET

Get indexer cluster health check results.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/health

XML Response

cluster/manager/indexes

https://:/services/cluster/manager/indexes

Access cluster index information.

GET

List cluster indices.

Request parameters

None

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/indexes

XML Response

cluster/manager/indexes/{name}

https://:/services/cluster/manager/indexes/{name}

Access specific cluster index information.

GET

List {name} index information.

Request parameters

None

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/indexes/_audit

XML Response

cluster/manager/info

https://:/services/cluster/manager/info

Access information about cluster manager node.

GET

List cluster manager node details.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/info

XML Response

cluster/manager/peers

https://:/services/cluster/manager/peers

Access cluster manager peers.

See also
cluster/manager/control/control/remove_peers

GET

List cluster manager peers.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/peers

XML Response

cluster/manager/peers/{name}

https://:/services/cluster/manager/peers/{name}

Access specified peer.

GET

Get {name} peer information.

Request parameters

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/peers/29F9560E-A44A-425C-8753-1C6158B46C84

XML Response

cluster/manager/redundancy

https://:/services/cluster/manager/redundancy

Display the details of all cluster managers participating in cluster manager redundancy, and switch the HA state of the cluster managers.

Authentication and authorization
The GET on this endpoint needs the capability list_indexer_cluster, and the POST on this endpoint needs the capability edit_indexer_cluster.

GET

Display the details of all cluster managers participating in cluster manager redundancy.

Request parameters

None

Returned values

Example request and response

Request

curl -k -u admin:changeme -XGET "https://mrt:15511/services/cluster/manager/redundancy/?output_mode=json"

Response

{ "links":{ "create":"/services/cluster/manager/redundancy/_new" }, "origin":"https://mrt:15511/services/cluster/manager/redundancy", "updated":"2022-01-25T08:29:41+00:00", "generator":{ "build":"e578ec650c0bf4d48e84541eae3d501f6dfc688a", "version":"20211229" }, "entry":[ { "name":"7EE219C0-23A6-4E95-A599-64E0FE5E8B05", "id":"https://mrt:15511/services/cluster/manager/redundancy/7EE219C0-23A6-4E95-A599-64E0FE5E8B05", "updated":"1970-01-01T00:00:00+00:00", "links":{ "alternate":"/services/cluster/manager/redundancy/7EE219C0-23A6-4E95-A599-64E0FE5E8B05", "list":"/services/cluster/manager/redundancy/7EE219C0-23A6-4E95-A599-64E0FE5E8B05", "edit":"/services/cluster/manager/redundancy/7EE219C0-23A6-4E95-A599-64E0FE5E8B05" }, "author":"system", "acl":{ "app":"", "can_list":true, "can_write":true, "modifiable":false, "owner":"system", "perms":{ "read":[ "admin", "splunk-system-role" ], "write":[ "admin", "splunk-system-role" ] }, "removable":false, "sharing":"system" }, "content":{ "active_bundle_id":"075EA8FB2D1172A1A7AD9DA472C63E92", "eai:acl":null, "generation_id":"21", "ha_mode":"Active", "last_heartbeat":0, "manager_switchover_mode":"auto", "peers_count":"5", "server_name":"cm", "uri":"https://mrt:15511" } }, { "name":"841BD315-21DB-4589-8813-15199DF02F1F", "id":"https://mrt:15511/services/cluster/manager/redundancy/841BD315-21DB-4589-8813-15199DF02F1F", "updated":"1970-01-01T00:00:00+00:00", "links":{ "alternate":"/services/cluster/manager/redundancy/841BD315-21DB-4589-8813-15199DF02F1F", "list":"/services/cluster/manager/redundancy/841BD315-21DB-4589-8813-15199DF02F1F", "edit":"/services/cluster/manager/redundancy/841BD315-21DB-4589-8813-15199DF02F1F" }, "author":"system", "acl":{ "app":"", "can_list":true, "can_write":true, "modifiable":false, "owner":"system", "perms":{ "read":[ "admin", "splunk-system-role" ], "write":[ "admin", "splunk-system-role" ] }, "removable":false, "sharing":"system" }, "content":{ "active_bundle_id":"075EA8FB2D1172A1A7AD9DA472C63E92", "eai:acl":null, "generation_id":"21", "ha_mode":"Standby", "last_heartbeat":1643099380, "manager_switchover_mode":"auto", "peers_count":"5", "server_name":"cm-standby2", "uri":"https://wimpy:14089" } } ], "paging":{ "total":2, "perPage":30, "offset":0 }, "messages":[

] }

POST

Switch the high availability state of the cluster managers.

Request parameters

_action=switch_mode

ha_mode=Active|Standby

Returned values

Example request and response

Request

curl -k -u admin:changeme -XPOST "https://10.16.88.2:15511/services/cluster/manager/redundancy/?output_mode=json" -d "_action=switch_mode" -d "ha_mode=Active"

Response

{ "links":{ "create":"/services/cluster/manager/redundancy/_new" }, "origin":"https://10.16.88.2:15511/services/cluster/manager/redundancy", "updated":"2021-10-14T04:15:00-07:00", "generator":{ "build":"42f3134682e376e692f6e407a83b41c8dd787e9e", "version":"20211011" }, "entry":[ { "name":"0AB9404D-8670-4F26-8723-CA289A5A0E3A", "id":"https://10.16.88.2:15511/services/cluster/manager/redundancy/0AB9404D-8670-4F26-8723-CA289A5A0E3A", "updated":"1969-12-31T16:00:00-08:00", "links":{ "alternate":"/services/cluster/manager/redundancy/0AB9404D-8670-4F26-8723-CA289A5A0E3A", "list":"/services/cluster/manager/redundancy/0AB9404D-8670-4F26-8723-CA289A5A0E3A", "edit":"/services/cluster/manager/redundancy/0AB9404D-8670-4F26-8723-CA289A5A0E3A" }, "author":"system", "acl":{ "app":"", "can_list":true, "can_write":true, "modifiable":false, "owner":"system", "perms":{ "read":[ "admin", "splunk-system-role" ], "write":[ "admin", "splunk-system-role" ] }, "removable":false, "sharing":"system" }, "content":{ "eai:acl":null, "ha_mode":"Active" } } ], "paging":{ "total":1, "perPage":30, "offset":0 }, "messages":[

] }

cluster/manager/sites

https://:/services/cluster/manager/sites

Access cluster site information.

GET

List available cluster sites.

Request parameters

None

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/sites

XML Response

cluster/manager/sites/{name}

https://:/services/cluster/manager/sites/{name}

Access specific cluster site information.

GET

List the {name} cluster site information.

Request parameters

None

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/sites/site1

XML Response

cluster/manager/status

https://:/services/cluster/manager/status

Endpoint to get the status of a rolling restart.

GET

Get the status of a rolling restart.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/manager/status

XML Response

cluster/searchhead/generation

https://:/services/cluster/searchhead/generation

Access peer information in a cluster searchhead.

GET

List peers available to a cluster searchhead.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/searchhead/generation

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

cluster/searchhead/generation/{name}

https://:/services/cluster/searchhead/generation/{name}

Access peer of the manager URI.

GET

Get {name} searchhead generation ID and generation peers.

Request parameters

None

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/searchhead/generation/https%3A%252F%252Fmyserver-mbp15.sv.splunk.com%3A8989

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

cluster/searchhead/searchheadconfig

https://:/services/cluster/searchhead/searchheadconfig

Access cluster searchhead node configuration.

GET

List this cluster search head node configuration.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/cluster/searchhead/searchheadconfig

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

POST

Configure this server as a cluster searchhead node.

Request parameters

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://myserver:8089/services/cluster/searchhead/searchheadconfig -d name=https://myserver:4567 -d secret=testsecret

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

cluster/searchhead/searchheadconfig/{name}

https://:/services/cluster/searchhead/searchheadconfig/{name}

Manage node in a cluster.

DELETE

Remove node from cluster.

Request parameters

None

Returned values
None

Example request and response

XML Request

curl -k -u admin:changeme --request DELETE https://myserver.splunk.com:8089/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Fmyserver%3A8211

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

GET

List cluster search head node configuration.

Request parameters

None

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://myserver.splunk.com:7588/services/cluster/searchhead/searchheadconfig/https%3A%252F%252Flocalhost%3A4567

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

POST

Update cluster search head node configuration.

Request parameters

Returned values
None

cluster/peer/buckets

https://:/services/cluster/peer/buckets

Access cluster peers bucket configuration.

GET

List cluster peers bucket configuration.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/cluster/peer/buckets

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

cluster/peer/buckets/{name}

https://:/services/cluster/peer/buckets/{name}

Manage peer buckets.

DELETE

Remove specified bucket from peer node.

Request parameters

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass --request DELETE https://myserver:8089/services/cluster/peer/buckets/_internal~58~11111111-1111-1111-1111-111111111111 -d bucket_id="_internal5811111111-1111-1111-1111-111111111111"

XML Response

<feed xmlns="http://www.w3.org/2005/Atom"

 xmlns:s="http://dev.splunk.com/ns/rest"
 xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">

GET

List peer specified bucket information.

Request parameters

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/cluster/peer/buckets/_audit~0~B8B5E5C6-DB26-4952-AFB1-C5EFEFFFEA31

XML Response

. . . clusterpeerbuckets https://localhost:8189/services/cluster/peer/buckets 2012-09-05T12:40:43-07:00 Splunk ... opensearch nodes elided ... <s:messages/> _internal<del>1</del>50FCDB42-E167-458D-A6A9-E4587E8F16D9 https://localhost:8189/services/cluster/peer/buckets/_internal~1~50FCDB42-E167-458D-A6A9-E4587E8F16D9 2012-09-05T12:40:43-07:00 system <s:dict> <s:key name="checksum"> ... eai:acl node elided ... <s:key name="eai:attributes"> <s:dict> <s:key name="optionalFields"> <s:list/> <s:key name="requiredFields"> <s:list/> <s:key name="wildcardFields"> <s:list/> <s:key name="earliest_time">0 <s:key name="generations"> <s:dict> <s:key name="0">0xffffffffffffffff <s:key name="latest_time">0 <s:key name="search_state">Searchable <s:key name="status">StreamingSource

cluster/peer/control/control/decommission

https://:/services/cluster/peer/control/control/decommission

Endpoint to decommission an indexer cluster peer node.

POST

Decommission a peer node.

Returned values
None

Example request and response

XML Request

curl -k -u admin:pass https://indexer:8089/services/cluster/peer/control/control/decommission -X POST

XML Response

cluster/peer/control/control/re-add-peer

https://:/services/cluster/peer/control/control/re-add-peer

Set the peer to re-add itself to the manager. This syncs the peer's state, including its in-memory bucket state, to the manager. By default, this resets the peer's primary bucket copies and the manager reassigns them across the cluster. To keep the peer's existing primary bucket copies, use the optional clearMasks=false parameter.

This endpoint can be useful when the manager and the peer have a state mismatch, for example when bucket information is not in sync between them.

POST

Re-add the cluster indexer to the cluster manager.

Request parameters

Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/cluster/peer/control/control/re-add-peer -d clearMasks=false -X POST

XML Response

cluster/peer/control/control/set_detention_override

https://:/services/cluster/peer/control/control/set_manual_detention

Deprecated. Use /set_manual_detention to manage peer node manual detention mode.

cluster/peer/control/control/set_manual_detention

https://:/services/cluster/peer/control/control/set_manual_detention

If you have Splunk Enterprise, you can use this endpoint to put the peer node in manual detention mode or take the peer out of this mode. In manual detention, the peer does not serve as a replication target. Detention helps slow the growth of disk usage on the peer.

Note:

• This endpoint replaces the /set_detention_override endpoint.
• Starting with Splunk Enterprise software version 6.5, manual detention persists through restarts.
• For more information, see Put a peer in detention in Managing Indexers and Clusters of Indexers.

POST

Adjust cluster peer detention mode.

Request parameters

Returned values
None

Example request and response

XML Request

curl -k -u admin:password https://localhost:8089/services/cluster/peer/control/control/set_manual_detention -d manual_detention=on

XML Response

. . .

cluster/peer/info

https://:/services/cluster/peer/info

Access cluster peer node information.

GET

List peer information.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/cluster/peer/info

XML Response

. . . clusterpeerinfo https://localhost:8189/services/cluster/peer/info 2012-09-05T12:45:59-07:00 Splunk ... opensearch nodes elided ... <s:messages/> peer https://localhost:8189/services/cluster/peer/info/peer 2012-09-05T12:45:59-07:00 system <s:dict> <s:key name="active_bundle"> <s:dict> <s:key name="bundle_path">/Applications/splunk-peer/var/run/splunk/cluster/remote-bundle/0f6078895127ab1f715ee78a6e1ff8a1-1346858928.bundle <s:key name="checksum">36a883f4d47af66f78531ef474349b59 <s:key name="timestamp">1346858928 <s:key name="base_generation_id">2 ... eai:acl node elided ... <s:key name="invalid_bundle_ids"> <s:list/> <s:key name="is_registered">1 <s:key name="last_heartbeat_attempt">1346874358 <s:key name="latest_bundle"> <s:dict> <s:key name="bundle_path">/Applications/splunk-peer/var/run/splunk/cluster/remote-bundle/0f6078895127ab1f715ee78a6e1ff8a1-1346858928.bundle <s:key name="checksum">36a883f4d47af66f78531ef474349b59 <s:key name="timestamp">1346858928 <s:key name="restart_state">NoRestart <s:key name="status">Up

Search head cluster endpoints

The endpoints in this section pertain to search head clusters.

All endpoints contain shcluster in their URIs pertain to search head clusters. For more information about search head clustering architecture, see Search head clustering architecture in the Distributed Search manual.

replication/configuration/health

https://:/services/replication/configuration/health

Access configuration replication health statistics for a search head cluster.

GET

Access the configuration replication health statistics for a search head cluster.

Request parameters

Returned values

Values returned depend on the request parameters used.

**bookmark**

Example request and response

curl -k -u admin:pass https://localhost:8089/services/replication/configuration/health?bookmark=1

... bookmark https://localhost:11089/services/replication/configuration/health/bookmark 2016-08-08T17:08:25-07:00 <s:dict> <s:key name="CaptainDummyOpId" title="undefined" rel="noopener noreferrer">https://localhost:11089">CaptainDummyOpId: Mon Aug 8 16:08:55 2016 <s:key name="2d9e86111eb4a377c60563f93ea5274de8b9c438" title="undefined" rel="noopener noreferrer">https://localhost:8089">2d9e86111eb4a377c60563f93ea5274de8b9c438: Mon Aug 8 17:08:22 2016 <s:key name="2d9e86111eb4a377c60563f93ea5274de8b9c438" title="undefined" rel="noopener noreferrer">https://localhost:9089">2d9e86111eb4a377c60563f93ea5274de8b9c438: Mon Aug 8 17:08:22 2016

**check_share_baseline**

Application usage
This parameter compares the baseline between the current instance, on which the GET request is made, with the baseline of other members. From each of the other members, the system retrieves the oldest changeset that is not more than 23 hours old and therefore safe from purging. The system then tries to find that changeset in the current instance's local changeset repository. If the changeset is found in the local repository, then the current instance and the member share a baseline.

Establishing a shared baseline between a captain and members is a prerequisite for successful configuration replication.

Example request and response

curl -k -u admin:pass https://localhost:11089/services/replication/configuration/health?check_share_baseline=1

... health https://localhost:11089/services/replication/configuration/health 2016-08-09T15:51:06-07:00 Splunk <a href="https://localhost:8089" title="undefined" rel="noopener noreferrer">https://localhost:8089</a> https://localhost:11089/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A8089 2016-08-09T15:51:06-07:00 <s:dict> <s:key name="check_share_baseline">Yes <s:key name="server_name">yxu-mbp15-node2 <a href="https://localhost:9089" title="undefined" rel="noopener noreferrer">https://localhost:9089</a> https://localhost:11089/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A9089 2016-08-09T15:51:06-07:00 <s:dict> <s:key name="check_share_baseline">Yes <s:key name="server_name"> localhost-node3 <a href="https://localhost:11089" title="undefined" rel="noopener noreferrer">https://localhost:11089</a> https://localhost:11089/services/replication/configuration/health/https%3A%2F%2Flocalhost%3A11089 2016-08-09T15:51:06-07:00 <s:dict> <s:key name="check_share_baseline">Yes <s:key name="server_name"> localhost-node1 ...

**unpublished**

A Number of unpublished changes key is returned with one of the following values.

Example request and response

curl -k -u admin:pass https://localhost:11089/services/replication/configuration/health?unpublished=1

replication/configuration/quarantined-assets

https://:/services/replication/configuration/quarantined-assets

Access information about quarantined lookups in a search head cluster.

GET

Access information about quarantined lookups in a search head cluster.

Request parameters
None

Returned values

Example request and response

curl -k -u admin:pass https://localhost:8090/services/replication/configuration/quarantined-assets

... quarantined-assets https://localhost:8090/services/replication/configuration/quarantined-assets/quarantined-assets 1970-01-01T00:00:00+00:00 <s:dict> <s:key name="assetId">b4c9340713a5dd8c61105b05acea79fbbd3fc98d <s:key name="assetURI">/nobody/search/lookups/test.csv <s:key name="user">nobody <s:key name="app">search <s:key name="assetType">lookups <s:key name="assetName">test.csv <s:key name="quarantineInfo">[ {quarantined_at_host=https://localhost:8090, quarantined_at=1724885036, lookup_size=30246329, quarantine_reason=large_lookup} ]

shcluster/captain/artifacts

https://:/services/shcluster/captain/artifacts

Provides list of artifacts and replicas currently managed by the captain across a searchhead cluster.

This endpoint can only be accessed on the captain. The response lists all artifacts that are currently resident on the set of search head cluster members.

An artifact in search head clustering is a managed search directory. Currently, only scheduled search results directories are managed and replicated according to replication policy.

Note: Ad hoc searches are not considered artifacts and are not listed.

GET

Lists searchhead cluster artifacts and replicas.

Request parameters

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/captain/artifacts

XML Response

shcluster/captain/artifacts/{name}

https://:/services/shcluster/captain/artifacts/{name}

Get artifact information for a specific artifact.

GET

Get artifact information, size, replicas and earliest service time.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://locahost:8089/services/shcluster/captain/artifacts/scheduler__nobody__simplexml__RMD5dc07327042a35a17_at_1469214000_37_11111111-1111-1111-1111-111111111111

XML Response

shcluster/captain/control/default/restart

https://:/services/shcluster/captain/control/default/restart

Endpoint to initiate rolling restart of a search head cluster.

POST

Initiates rolling restart of a search head cluster

Request parameters

Returned values
None

Example request and response

XML Request

curl -k -u admin:password https://localhost:8089/services/shcluster/captain/control/default/restart -d searchable=1 -d force=1 -d decommission_search_jobs_wait_secs=30 -X POST

XML Response

shcluster/captain/control/control/rotate-splunk-secret

https://:/services/shcluster/captain/control/control/rotate-splunk-secret

Rotates the splunk.secret file on all nodes of a search head cluster.

POST

Rotates the splunk.secret file on all nodes of a search head cluster.

Returned values
None

Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/shcluster/captain/control/control/rotate-splunk-secret -X POST

XML Response

shcluster/captain/control/control/upgrade-init

https://:/services/shcluster/captain/control/control/upgrade-init

Initializes a search head cluster rolling upgrade.

POST

Initializes a search head cluster rolling upgrade.

Returned values
None

Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/shcluster/captain/control/control/upgrade-init -X POST

XML Response

shcluster/captain/control/control/upgrade-finalize

https://:/services/shcluster/captain/control/control/upgrade-finalize

Finishes a search head cluster rolling upgrade.

POST

Finishes a search head cluster rolling upgrade.

Returned values
None

Example request and response

XML Request

curl -k -u admin:changeme https://localhost:8089/services/shcluster/captain/control/control/upgrade-finalize -X POST

XML Response

shcluster/captain/info

https://:/services/shcluster/captain/info

Access information about searchhead cluster captain node.

GET

List searchhead cluster captain node details.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/shcluster/captain/info

XML Response

shcluster/captain/jobs

https://:/services/shcluster/captain/jobs

List running and recently finished jobs for all cluster members.

GET

List running and recently finished jobs for this cluster.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
For each job:

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/shcluster/captain/jobs

XML Response

shcluster/captain/jobs/{name}

https://:/services/shcluster/captain/jobs/{name}

GET

Get running and recently finished jobs for {name} cluster.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response
XML Request

curl -k -u admin:pass https://localhost:8089/services/shcluster/captain/jobs/scheduled_sample%20scheduled%20search%20for%20dashboards%20%28existing%20job%20case%29%20timechart_12944444515

XML Response

shcluster/captain/members

https://:/services/shcluster/captain/members

Lists the search head cluster members.

GET

List cluster members.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/shcluster/captain/members

XML Response

shcluster/captain/members/{name}

https://:/services/shcluster/captain/members/{name}

Get information about the {name} searchhead cluster member.

GET

Get information about the {name} searchhead cluster member.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8089/services/shcluster/captain/members/33333333-3333-3333-3333-333333333333

XML Response

shcluster/config

https://:/services/shcluster/config

List search head cluster node configuration.

GET

List search head cluster node configuration.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/config

XML Response

shcluster/config/config

https://:/services/shcluster/config/config

Configure search head cluster members.

POST

Configure search head cluster members.

Request parameters

Returned values
None

Example request and response

XML Request

curl -k -u admin:changed https://10.140.127.233:8089/services/shcluster/config/config -d rolling_restart=searchable -d decommission_search_jobs_wait_secs=120

XML Response

http://docs.splunk.com/Documentation/Splunk/7.2.0/RESTREF/RESTcluster

Example request and response for manual detention of a cluster member

XML Request

curl -k -u admin:changedpwd https://fool01.sv.splunk.com:8095/services/shcluster/config/config -d manual_detention=on -d target_uri=https://test.sv.splunk.com:8080

XML Response

shcluster/member/artifacts

https://:/services/shcluster/member/artifacts

Manage searchhead cluster member artifact configuration.

GET

List searchhead cluster members artifact configuration.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
For each member:

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/artifacts

XML Response

shcluster/member/artifacts/{name}

https://:/services/shcluster/member/artifacts/{name}

Get {name} member artifact configuration.

GET

List {name} member artifact information.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/artifacts/scheduler__admin_U0Etbml4__RMD592d31e53ed62579e_at_1413518400_762_88888888-8888-8888-8888-888888888888

XML Response

shcluster/member/control/control/set_manual_detention

https://://services/shcluster/member/control/control/set_manual_detention

Put the search head cluster member in manual detention mode or take the search head cluster member out of this mode. When a search head cluster member is in manual detention, it does not accept new search jobs, including both scheduled and ad-hoc searches. Existing search jobs run to completion. It also participates in cluster administration operations with the exception of artifact replication.

POST

Adjust search head manual detention mode.

Request parameters

Returned values
None

Example request and response

XML Request

curl -u admin:password -k https://localhost:8089/servicesNS/admin/search/shcluster/member/control/control/set_manual_detention -d manual_detention=on

XML Response

shcluster/member/consensus

https://:/services/shcluster/member/consensus

Get latest cluster configuration from the raft consensus protocol.

GET

Get latest cluster configuration from the raft consensus protocol.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
These values are returned for each member.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/consensus

XML Response

shcluster/member/info

https://:/services/shcluster/member/info

Access searchhead cluster member node information.

GET

List member information.

Request parameters

Pagination and filtering parameters can be used with this method.

Returned values
These values are returned for each member.

Example request and response

XML Request

curl -k -u admin:pass https://localhost:8189/services/shcluster/member/info

XML Response

shcluster/status

https://:/services/shcluster/status

Performs health checks to determine search head cluster health status, prior to a rolling upgrade or rolling restart.

Authentication and Authorization

Requires the admin role or list_search_head_clustering capability.

GET

Get search head cluster health status information .

Request parameters

Returned values
These values are returned for each member.

Example request and response

XML Request

curl -k -u admin:changed123 https://localhost:8089/services/shcluster/status?advanced=1?

XML Response

upgrade/shc/recovery

https://:/services/upgrade/shc/recovery

Return search head cluster to ready state after automated rolling upgrade failure.

Authentication and Authorization
Requires admin role or another role containing these capabilties:

• upgrade_splunk_shc
• list_search_head_clustering
• list_settings
• use_remote_proxy

POST

Return SHC to ready state after automated rolling upgrade failure.

Request parameters

None

Returned values

Example request and response

JSON Request

curl -X POST -u admin:pass -k https://localhost:8089/services/upgrade/shc/recovery?output_mode=json

JSON Response

{ "updated":"2022-11-24T17:36:20+0000", "author":"Splunk", "layout":"props", "entry":[ { "title":"recovery", "id":"/services/upgrade/shc/recovery", "updated":"2022-11-24T17:36:20+0000", "links":{ "alternate":{ "href":"shc/recovery" } }, "content":{ "message":"Instance recovered successfully", "status":"succeeded" } } ] }

upgrade/shc/status

https://:/services/upgrade/shc/status

Check the status of an automated search head cluster rolling upgrade.

Authentication and Authorization
Requires admin role or another role containing these capabilities:

• upgrade_splunk_shc
• list_search_head_clustering
• list_settings
• use_remote_proxy

GET

Check the status of automated SHC rolling upgrade.

Request parameters

None

Returned values

Example request and response

JSON Request

curl -u admin:pass -k https://localhost:8089/services/upgrade/shc/status?output_mode=json

JSON Response

{ "updated":"2022-11-24T17:33:28+0000", "author":"Splunk", "layout":"props", "entry":[ { "title":"status", "id":"/services/upgrade/shc/status", "updated":"2022-11-24T17:33:28+0000", "links":{ "alternate":{ "href":"shc/status" } }, "content":{ "message":{ "upgrade_status":"completed", "statistics":{ "peers_to_upgrade":3, "overall_peers_upgraded":3, "overall_peers_upgraded_percentage":100 }, "peers":[ { "name":"sh2", "status":"upgraded", "last_modified":"Thu Nov 24 17:29:41 2022" }, { "name":"sh1", "status":"upgraded", "last_modified":"Thu Nov 24 17:28:07 2022" }, { "name":"sh3", "status":"upgraded", "last_modified":"Thu Nov 24 17:31:15 2022" } ] } } } ] }

upgrade/shc/upgrade

https://:/services/upgrade/shc/upgrade

Initiate an automated rolling upgrade of a search head cluster.

Authentication and Authorization
Requires admin role or another role containing these capabilities:

• upgrade_splunk_shc
• list_search_head_clustering
• list_settings
• use_remote_proxy

POST

Initiate automated SHC rolling upgrade.

Request parameters

None

Returned values

Example request and response

JSON Request

curl -X POST -u admin:pass -k https://localhost:8089/services/upgrade/shc/upgrade?output_mode=json

JSON Response

{ "updated":"2022-11-24T17:25:54+0000", "author":"Splunk", "layout":"props", "entry":[ { "title":"upgrade", "id":"/services/upgrade/shc/upgrade", "updated":"2022-11-24T17:25:54+0000", "links":{ "alternate":{ "href":"shc/upgrade" } }, "content":{ "message":"Upgrade initiated", "status":"succeeded" } } ] }