Splunk Cloud Platform

https://help.splunk.com/en/splunk-cloud-platform
Admin
Splunk Cloud Platform is a cloud-native data analytics platform that collects, indexes, and...
Tokens:8,750,701
Snippets:45,500
Trust Score:10
Update:1 day ago
Show doc for...
Tokens:
Raw
### Describe an app response with installed status

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-private-apps-in-splunk-cloud-platform

Example response from the GET request showing the app installation status as "installed". If the response returns "404-app-not-found", installation is still in progress.

```json
{
   "label": "tos",
   "name": "tos",
   "status": "installed",
   "version": ""
}
```

--------------------------------

### Response for successful app installation

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-private-apps-in-splunk-cloud-platform

Example JSON response showing the app is installed. The status field is 'installed' when installation completes successfully.

```json
{
   "label": "pa1",
   "name": "pa1",
   "package": "pa1-1.0.31.tar.gz",
   "status": "installed",
   "version": "1.0.31"
}
```

--------------------------------

### View installed apps response

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-private-apps-in-splunk-cloud-platform

Example JSON response from the GET request. Returns a list of apps with label, name, status, and version.

```json
{
   "apps": [
       {
           "label": "075-cloudworks",
           "name": "075-cloudworks",
           "status": "installed",
           "version": ""
       },
       {
           "label": "100-cloudworks-wlm",
           "name": "100-cloudworks-wlm",
           "status": "installed",
           "version": ""
       },
     
       
       {
           "label": "tos",
           "name": "tos",
           "status": "installed",
           "version": ""
       }
   ]
}
```

--------------------------------

### GET app: JSON response

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/admin-config-service-acs-api-endpoint-reference/admin-config-service-acs-api-endpoint-reference

Example JSON response from the GET app request. Contains the app label, name, installation status, and version.

```json
{
   "label": "testapp",
   "name": "testapp",
   "status": "installed",
   "version": ""
}
```

--------------------------------

### Install app response showing status installed

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-private-apps-in-splunk-cloud-platform

Example JSON response from the install request. Shows the app label, name, status "installed", and version. If status is "uploaded", installation is still in progress.

```json
{
   "label": "pa1",
   "name": "pa1",
   "status": "installed",
   "version": "1.2.2"
}
```

--------------------------------

### Non-interactive install and start universal forwarder

Source: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual/10.4/install-the-universal-forwarder/install-a-nix-universal-forwarder

Installs and starts the universal forwarder in non-interactive mode. Extracts the package to /opt, starts the forwarder, accepts the license, answers yes to prompts, suppresses interactive prompts, and sets the initial password. Replace <version> and <YOUR_PASSWORD> with actual values.

```bash
sudo tar xzf splunkforwarder-<version>.tgz -C /opt && sudo /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes --no-prompt --seed-passwd <YOUR_PASSWORD>
```

--------------------------------

### Example XML response for migration start

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/kv-store-endpoints/kv-store-endpoint-descriptions

Example XML response indicating that the migration was successfully triggered.

```xml
.  <s:messages>                                                                                                                          
    <s:msg type="INFO">SHC KV Store migration has been successfully triggered</s:msg>                                                   
  </s:messages>
```

--------------------------------

### Installation success message

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-manual/10.6/get-data-into-splunk-cloud-platform/get-nix-data-into-splunk-cloud-platform

Expected output after starting the forwarder, indicating successful installation.

```text
All installed files intact. 
Done
All preliminary checks passed. 
Starting splunk server daemon (splunkd)...
Done
```

--------------------------------

### Response for describing an app

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-private-apps-in-splunk-cloud-platform

Example JSON response for the describe app request. The status field is 'installed' when installation is complete.

```json
{
   "label": "",
   "name": "",
   "package": "pa1-1.0.31.tar.gz",
   "status": "installed",
   "version": "1.0.31"
}
```

--------------------------------

### Install Splunkbase app response (JSON)

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-splunkbase-apps-in-splunk-cloud-platform

Example response from the app installation request. The status field shows 'processing' when installation is in progress, or 'installed' when complete.

```json
{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks App for Splunk",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "processing",
   "version": "7.0.4"
}
```

--------------------------------

### Start Kafka Connect with connect-distributed.sh

Source: https://help.splunk.com/en/splunk-cloud-platform/get-data-in/splunk-connect-for-kafka/2.1/configure/configure-splunk-connect-for-kafka

Command to start Kafka Connect on a host. Replace $KAFKA_HOME with the Kafka install directory.

```bash
.$KAFKA_HOME/bin/connect-distributed.sh config/connect-distributed.properties
```

--------------------------------

### Install remote upgrader with default user

Source: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/splunk-remote-upgrader-for-linux-universal-forwarders/10.4/quickstart-guide/quickstart-guide

Run this command to start the installation process. Root permission is required. The --create-user flag creates a dedicated user/group with minimum permissions.

```bash
sudo ./bin/install.sh --accept-license --create-user
```

--------------------------------

### POST install app example request and response

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/admin-config-service-acs-api-endpoint-reference/admin-config-service-acs-api-endpoint-reference

Example curl request to install a private app using a form with an AppInspect token and package file, and the corresponding JSON response with app details. Requires a JWT token, AppInspect token, and legal acknowledgement for unsupported apps.

```json
curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/apps' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0IiwiYWxnI…' \
--form 'token="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9…"' \
--form 'package=@"/Users/{name}/app_inspect/testapp.tar.gz"'
```

```json
{
   "label": "testapp",
   "name": "testapp",
   "package": "testapp.tar.gz",
   "status": "installed",
   "version": "1.0.31"
}
```

--------------------------------

### Example response for GET permissions

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/search-endpoints/search-endpoint-descriptions

Example response showing permissions for roles *, admin, power, analyst, and user on module my_module.

```json
[
 {
  "resourceType": "module",
  "resourceName": "my_module",
  "role": "*"
  "operations": [
    "execute"
  ]
 },
 {
  "resourceType": "module",
  "resourceName": "my_module",
  "role": "admin"
  "operations": [
    "execute",
    "read",
    "write"
  ]
 },
 {
  "resourceType": "module",
  "resourceName": "my_module",
  "role": "power"
  "operations": [
    "execute",
    "read",
    "write"
  ]
 },
 {
  "resourceType": "module",
  "resourceName": "my_module",
  "role": "analyst"
  "operations": [
    "execute",
    "read"
  ]
 },
 {
  "resourceType": "module",
  "resourceName": "my_module",
  "role": "user"
  "operations": [
    "execute"
  ]
 }
]
```

--------------------------------

### Start Splunk with license acceptance and answer-no

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-manual/10.6/get-data-into-splunk-cloud-platform/upgrade-your-forwarders

Starts Splunk, accepts the license, and answers 'n' to preview configuration changes before continuing the upgrade.

```bash
$SPLUNK_HOME/bin/splunk start --accept-license --answer-no
```

--------------------------------

### Install kinit with apt-get

Source: https://help.splunk.com/en/splunk-cloud-platform/connect-relational-databases/deploy-and-use-splunk-db-connect/4.3/install-splunk-db-connect/install-database-drivers

Installs the kinit utility on the machine running DB Connect. If prompted for a realm, enter the domain name in upper-case letters.

```bash
apt-get install krb5-user
```

--------------------------------

### GET trusted connections curl request

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.4.2604/topology-endpoints/topology-endpoint-descriptions

Example curl command to retrieve trusted connection configuration for a node identified by {guid}.

```bash
curl -k -u admin:<password> \
  https://127.0.0.1:<port>/services/stack-explainer/v1/trusted-connections/{guid}
```

--------------------------------

### summary command example

Source: https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-splunk-app-for-data-science-and-deep-learning/5.2.0/use-the-splunk-app-for-data-science-and-deep-learning/splunk-app-for-data-science-and-deep-learning-commands

Example of retrieving metadata for `app:barebone_template`, including training configurations and feature names.

```splunk
| summary app:barebone_template
```

--------------------------------

### Start Splunk with license acceptance and answer-yes

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-manual/10.6/get-data-into-splunk-cloud-platform/upgrade-your-forwarders

Starts Splunk, accepts the license, and answers 'y' to begin the upgrade without viewing configuration changes.

```bash
$SPLUNK_HOME/bin/splunk start --accept-license --answer-yes
```

--------------------------------

### Example request and response for GET node-identity

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.6/topology-endpoints/topology-endpoint-descriptions

Shows a curl command to retrieve node identity and the successful JSON response. The request uses the /services/stack-explainer/v1/node-identity/{guid} endpoint.

```bash
curl -k -u admin:<password> \
  https://127.0.0.1:<port>/services/stack-explainer/v1/node-identity/{guid}
```

```json
{
  "header": { "timestamp": "2026-04-07T11:13:02Z" },
  "fips_enabled": false,
  "host_info": {
    "fqdn": "indexer-2.example.com",
    "mgmt_scheme": "https",
    "mgmt_hostname": "10.0.0.6",
    "mgmt_port": 8089,
    "web_scheme": "https",
    "web_port": 8000
  },
  "roles": ["indexer", "cluster_peer"],
  "version_info": { "build": "37c5143b091f", "version": "10.6.0" },
  "os_info": { "build": "build-67890", "name": "Linux", "version": "5.15" }
}
```

--------------------------------

### GET /captureipaddresses/whitelist - Example Response

Source: https://help.splunk.com/en/splunk-cloud-platform/collect-stream-data/install-and-configure-splunk-stream/8.0/splunk-stream-rest-api/splunk-stream-rest-api-reference

Example JSON response for the GET request, showing an empty whitelist.

```json
{"_user": "nobody", "_key": "whitelist", "ipAddresses": [], "id": "whitelist"}
```

--------------------------------

### Example wmi.conf file with settings and WMI stanzas

Source: https://help.splunk.com/en/splunk-cloud-platform/get-data-in/get-started-with-getting-data-in/10.5.2605/get-windows-data/monitor-data-through-windows-management-instrumentation-wmi

A complete wmi.conf example showing the [settings] stanza and several WMI stanzas (AppAndSys, LocalSplunkWmiProcess, TailApplicationLogs, ProcessCreation, USBChanges). Note that WQL query stanzas do not update the WMI checkpoint file, so data is indexed as fresh each run, potentially causing duplicate events.

```ini
[settings]
initial_backoff = 5
max_backoff = 20
max_retries_at_max_backoff = 2
checkpoint_sync_interval = 2

[WMI:AppAndSys]
server = foo, bar
interval = 10
event_log_file = Application, System, Directory Service
disabled = 0

[WMI:LocalSplunkWmiProcess]
interval = 5
wql = select * from Win32_PerfFormattedData_PerfProc_Process where Name = "splunk-wmi"
disabled = 0

# Listen from three event log channels, capturing log events that occur only
# while the Splunk platform runs.  Gather data from three machines.
[WMI:TailApplicationLogs]
interval = 10
event_log_file = Application, Security, System
server = srv1, srv2, srv3
disabled = 0
current_only = 1

# Listen for process-creation events on a remote machine
[WMI:ProcessCreation]
interval = 1
server = remote-machine
wql = select * from __InstanceCreationEvent within 1 where TargetInstance isa 'Win32_Process'
disabled = 0
current_only = 1

# Receive events whenever someone plugs/unplugs a USB device to/from the computer
[WMI:USBChanges]
interval = 1
wql = select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'
disabled = 0
current_only = 1
```

--------------------------------

### GET endpoint example response

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/manage-users-and-security/10.6/private-connectivity/set-up-egress-private-connectivity

Example response for the GET request, showing the status, reason, and dnsEnabled for each endpoint.

```json
{
  "endpoints": [
    {
      "endpoint": "com.amazonaws.vpce.us-east-1.vpce-svc-0e123abc123198abc",
      "status": "available",
      "reason": "initialized",
      "dnsEnabled": true
    },
    {
      "endpoint": "com.amazonaws.vpce.us-east-1.vpce-svc-0e123xyz123198xyz",
      "status": "unavailable",
      "reason": "initialization is in progress",
      "dnsEnabled": false
    }
  ]
}
```

--------------------------------

### sample command syntax

Source: https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/6.2.0/ai-toolkit-commands-macros-and-visualizations/search-commands-for-machine-learning

Shows the full syntax for the `sample` command with all optional parameters.

```splunk
sample [ratio=<float between 0 and 1>] [count=<positive integer>] [proportional=<name of numeric field> [inverse]] [partitions=<natural number  greater than 1> [fieldname=<string>]] [seed=<number>] [by <split_by_field>]
```

--------------------------------

### GET /indexers - Example Response

Source: https://help.splunk.com/en/splunk-cloud-platform/collect-stream-data/install-and-configure-splunk-stream/8.0/splunk-stream-rest-api/splunk-stream-rest-api-reference

Example JSON response for the GET /indexers request, showing a token and collector URLs.

```json
{"token": "978CE241-A655-4985-BCBE-F97163FF4DFC", "headerMeta": false, "collectors": ["https://dmillis-mbp15.splunk.local:8088"]}
```

--------------------------------

### Map color palette example

Source: https://help.splunk.com/en/splunk-cloud-platform/create-dashboards-and-reports/simple-xml-dashboards/10.5.2605/table-visualizations/table-column-simple-xml

Example of a map palette that assigns colors to specific cell values: 'online' gets #65A637 and 'offline' gets #6A5C9E.

```JSON
<colorPalette type="map">{"online":#65A637, "offline":#6A5C9E}
</colorPalette>
```

--------------------------------

### Build and start the Docker container

Source: https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/6.2.0/ai-toolkit-models/cisco-deep-time-series-model-on--premises-installation

Build the Docker image and start the container in the background.

```bash
docker compose up --build
```

--------------------------------

### Start Kafka server and Kafka Connect

Source: https://help.splunk.com/en/splunk-cloud-platform/get-data-in/splunk-connect-for-kafka/2.2/configure/security-configurations-for-splunk-connect-for-kafka

Commands to start ZooKeeper, Kafka server, and Kafka Connect using the configuration files.

```bash
cd $KAFKA_HOME
bin/zookeeper-server-start.sh config/zookeeper.properties
bin/kafka-server-start.sh config/server.properties
./bin/connect-distributed.sh config/connect-distributed.properties
```

--------------------------------

### GET response example for collection items

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/kv-store-endpoints/kv-store-endpoint-descriptions

Example JSON response returned by a GET request to access a collection. Shows the structure with fields like myKey, _user, and _key.

```json
[ { "myKey" : "abc", "_user" : "nobody", "_key" : "5410be5441ba15298e4624d1" } ]
```

--------------------------------

### GET request example for data/ui/views/{name}

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/knowledge-endpoints/knowledge-endpoint-descriptions

Example curl command to retrieve the XML definition of an existing dashboard. Uses basic authentication and specifies the dashboard name 'my_dashboard'.

```bash
curl -k -u username:password 
https://localhost:8089/servicesNS/admin/search/data/ui/views/my_dashboard
```

--------------------------------

### Example response for limits.conf GET request

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-limits.conf-configurations-in-splunk-cloud-platform

Example JSON response returned by the GET request to the limits endpoint. It shows a list of editable limits.conf stanzas and their corresponding values.

```json
[{"Stanza":"join","Values":{"subsearch_maxout":"91519","subsearch_maxtime":"111","subsearch_timeout":"120"}},{"Stanza":"kv","Values":{"limit":"100","maxchars":"182"}},{"Stanza":"subsearch","Values":{"maxout":"10000","maxtime":"60"}}]
```

--------------------------------

### from example

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-reference/quick-reference-for-spl2-commands/quick-reference-for-spl2-commands

Retrieves data from a dataset. This example returns data from the main index for the last 5 minutes, groups by host, calculates the sum of bytes, and filters results where the sum is greater than 1 MB.

```SPL2
| FROM main 
  WHERE earliest=-5m@m AND latest=@m 
  GROUP BY host 
  SELECT sum(bytes) AS sum, host 
  HAVING sum > 1024*1024
```

--------------------------------

### Start universal forwarder and accept license

Source: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual/10.4/install-the-universal-forwarder/install-a-nix-universal-forwarder

Starts the universal forwarder and accepts the license agreement.

```bash
sudo /opt/splunkforwarder/bin/splunk start --accept-license
```

--------------------------------

### Run CheckMK install script

Source: https://help.splunk.com/en/splunk-cloud-platform/alert-and-respond/splunk-on-call/integrations-with-splunk-on-call/checkmk-integration-for-splunk-on-call

Creates copies of Nagios and environment configuration files and creates symlinks to them in the site Nagios directory. Replace <yoursitename> with your actual site name.

```default
/opt/victorops/nagios_plugin/omd_check_mk/install.sh <yoursitename>
```

--------------------------------

### Start Splunk Enterprise on Linux: Navigate to bin and start

Source: https://help.splunk.com/en/splunk-cloud-platform/get-started/search-tutorial/10.6/part-1-getting-started/launch-splunk-web

Use the Splunk CLI to start Splunk Enterprise. Navigate to the bin directory and run the start command.

```bash
cd <Splunk_Enterprise_Installation_Directory>/bin
./splunk start
```

--------------------------------

### GET configs/prefix - Example Request

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/admin-config-service-acs-api-endpoint-reference/admin-config-service-acs-api-endpoint-reference

Curl command to get the prefix to configure a bucket.

```bash
curl 'https://admin.splunk.com/{stack}/adminconfig/cloud-resources/self-storage-locations/configs/prefix' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiwi…'
```

--------------------------------

### NOT LIKE operator example

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-manual/expressions-and-predicates/predicate-expressions

Example of using the NOT LIKE operator to exclude patterns starting with '192.0.2.'.

```SPL2
client_ip NOT LIKE "192.0.2.%"
```

--------------------------------

### Start universal forwarder with license acceptance on Windows

Source: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual/10.4/configure-the-universal-forwarder/start-or-stop-the-universal-forwarder

Start the forwarder and accept the license agreement without reviewing it. Use on first start to skip the license prompt.

```powershell
cd %SPLUNK_HOME%\bin
.\splunk start --accept-license
```

--------------------------------

### SPL2 FROM clause example

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-overview/specific-differences-between-spl-and-spl2

SPL2 from command can start with FROM. This search produces the same results as the SELECT example.

```spl2
$from_example = FROM sample_data_index 
WHERE host="www2" 
GROUP BY action 
SELECT action, count(action) AS 'Action Count' 
ORDER BY action DESC
```

--------------------------------

### Create default.meta with export = system

Source: https://help.splunk.com/en/splunk-cloud-platform/developing-views-and-apps-for-splunk-web/10.5.2605/modular-inputs/create-a-custom-user-interface

Create a default.meta file at $SPLUNK_HOME/etc/apps/<myApp>/metadata/default.meta with the content [] export = system to share the modular input script with all users.

```ini
[]
export = system

```

--------------------------------

### Example: Add forward server idx1.mycompany.com:9997

Source: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual/10.6/configure-the-universal-forwarder/configure-the-universal-forwarder-using-configuration-files

Example command that connects the forwarder to a receiving indexer with hostname idx1.mycompany.com on port 9997.

```bash
./splunk add forward-server idx1.mycompany.com:9997
```

--------------------------------

### Example request and response

Source: https://help.splunk.com/en/splunk-cloud-platform/rest-api-reference/10.5.2605/knowledge-endpoints/knowledge-endpoint-descriptions

Example curl request to get data model information and the XML response.

```bash
curl -k -u admin:pass https://localhost:8089/services/datamodel/model/MyApp -d concise=true
```

```xml
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/"> <title></title> <id>https://myserver-centos62x64-4:8789/services/datamodel/model</id> <updated>2013-08-24T13:35:54-07:00</updated> <generator build="178272" version="6.0"/> <author> <name>Splunk</name> </author> <link href="/services/datamodel/model/\_new" rel="create"/> <link href="/services/datamodel/model/desc" rel="desc"/> <link href="/services/datamodel/model/report" rel="report"/> ... opensearch nodes elided ... <s:messages/> <entry> <title>MyApp</title> <id>https://myserver-centos62x64-4:8789/servicesNS/nobody/search/datamodel/model/MyApp</id> <updated>2013-08-24T13:35:54-07:00</updated> <link href="/servicesNS/nobody/search/datamodel/model/MyApp" rel="alternate"/> <author> <name>nobody</name> </author> <link href="/servicesNS/nobody/search/datamodel/model/MyApp" rel="list"/> <link href="/servicesNS/nobody/search/datamodel/model/MyApp" rel="edit"/> <content type="text/xml"> <s:dict> <s:key name="acceleration">{"enabled": false, "earliest\_time": "-1mon"}</s:key> <s:key name="description"><!\[CDATA\[{"modelName": "MyApp", "objects": [{"constraints": [{"search": "sourcetype=access\_\* OR . . . elided . . . "PodcastDownload", "WebSession", "User"], "description": "Data model for web analytics."}]\]> </s:key> <s:key name="displayName">Web Intelligence</s:key> ... eai:acl node elided ... <s:key name="eai:appName">search</s:key> <s:key name="eai:attributes">{'wildcardFields': [], 'requiredFields': [], 'optionalFields': ['acceleration', 'acceleration.cron\_schedule', 'acceleration.earliest\_time', 'eai:data']}</s:key> <s:key name="eai:digest">d73ff2d833e3104eed99a8fd258dbae1</s:key> <s:key name="eai:type">datamodels</s:key> <s:key name="eai:userName">admin</s:key> </s:dict> </content> </entry> </feed>
```

--------------------------------

### Split data into training set with sample command

Source: https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-splunk-app-for-data-science-and-deep-learning/5.2.0/use-the-splunk-app-for-data-science-and-deep-learning/develop-a-model-using-jupyterlab

Use the sample command to split data into a training set. The example uses partitions=10 and seed=42, selecting partition_number<7 for training.

```splunk
... | sample partitions=10 seed=42 | where partition_number<7
```

--------------------------------

### Start streamfwd service

Source: https://help.splunk.com/en/splunk-cloud-platform/collect-stream-data/install-and-configure-splunk-stream/8.0/install-and-configure-your-splunk-stream-forwarder/install-an-independent-stream-forwarder

Start the streamfwd service after installation. This command is used to launch the Independent Stream Forwarder.

```bash
sudo service streamfwd start
```

--------------------------------

### LIKE operator example with leading wildcard

Source: https://help.splunk.com/en/splunk-cloud-platform/search/spl2-search-manual/expressions-and-predicates/predicate-expressions

Example of using the LIKE operator to match a pattern starting with 'Pete'.

```SPL2
name LIKE "Pete%"
```

--------------------------------

### Example: Add sample_viz custom visualization

Source: https://help.splunk.com/en/splunk-cloud-platform/developing-views-and-apps-for-splunk-web/10.5.2605/custom-visualizations/custom-visualizations-in-simple-xml

Example of adding the sample_viz custom visualization from the viz_sample_app app to a dashboard panel.

```XML
<viz type="viz_sample_app.sample_viz">
...
</viz>
```

--------------------------------

### Example response for module GET

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.3.2512/search-endpoints/search-endpoint-descriptions

Shows the first few fields returned in the response for a module named 'test'.

```json
{
	"namespace": "~.apps.search",
	"name": "test",
	"definition": "import _internal from ~indexes\n\n$search = search index=_internal",
	"createdAt": "2025-12-18 10:49:00.004548Z",
	"createdBy": "admin",
	"updatedAt": "2025-12-18 10:49:00.004548Z",
	"updatedBy": "admin",
	"version": 1,
	"displayName": "test",
	"earliestTime": "-24h@h",
	"latestTime": "now",
	"canWrite": true
	...
}
```

--------------------------------

### GET collection item response JSON

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/kv-store-endpoints/kv-store-endpoint-descriptions

Example JSON document returned by a GET request for a collection item.

```json
{"myKey" : "abc", "myOtherKey" : "uvwxyz", "_user" : "nobody", "_key" : "5410c8dc41ba15298e4624d5"}
```

--------------------------------

### Example output of acs apps bulk-install private

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-cli/administer-splunk-cloud-platform-using-the-acs-cli

Shows the command output for vetting and installing a private app, including the vetting summary and installation status. The output includes an error example with statusCode 400 and a troubleshooting link.

```python
Processing app: empty_app.tgz
Inspecting your private app...
Submitted app for inspection (requestId='2b24db68-783f-4818-8786-c6f888120097')
Waiting for inspection to finish...
processing...success
Vetting completed, summary:
{
    "error": 0,
    "failure": 2,
    "skipped": 157,
    "manual_check": 0,
    "not_applicable": 4,
    "warning": 0,
    "success": 8
}
{
    "identifier": "inspect-empty_app.tgz",
    "requestID": "2b24db68-783f-4818-8786-c6f888120097",
    "statusCode": 200,
    "message": "vetting failed (failures=2, errors=0, manual check=0)",
    "response": "{\"request_id\":\"2b24db68-783f-4818-8786-c6f888120097\",\"status_code\":200,\"status\":\"SUCCESS\",\"info\":{\"error\":0,\"failure\":2,\"skipped\":157,\"manual_check\":0,\"not_applicable\":4,\"warning\":0,\"success\":8},\"links\":[{\"rel\":\"self\",\"href\":\"/v1/app/validate/status/2b24db68-783f-4818-8786-c6f888120097\"},{\"rel\":\"report\",\"href\":\"/v1/app/report/2b24db68-783f-4818-8786-c6f888120097\"}]}",
    "content-type": ""
}
Installing the app...
{
    "identifier": "install-empty_app.tgz",
    "requestID": "aed48907-416c-9d23-ade0-96b8c9841a89",
    "statusCode": 400,
    "message": "Extract app information from the package failed. Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips.",
    "response": "{\"code\":\"400-bad-request\",\"message\":\"Extract app information from the package failed. Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips.\"}\n",
    "content-type": "application/json; charset=UTF-8"
}
```

--------------------------------

### Start etcd service with systemctl

Source: https://help.splunk.com/en/splunk-cloud-platform/connect-relational-databases/deploy-and-use-splunk-db-connect/3.18/configure-and-manage-splunk-db-connect/configure-high-availability-on-top-of-heavy-forwarders

Reloads systemd, enables etcd to start on boot, and starts the etcd service. Then checks the service status to confirm it is running.

```bash
$ sudo systemctl daemon-reload
$ sudo systemctl enable etcd
$ sudo systemctl start etcd
```

```bash
$ systemctl status etcd.service
```

--------------------------------

### Example request and response

Source: https://help.splunk.com/en/splunk-cloud-platform/rest-api-reference/10.5.2605/knowledge-endpoints/knowledge-endpoint-descriptions

Example curl request and XML response for the GET directory endpoint. The request uses basic authentication and the response is an Atom feed with entries for each app-scoped object.

```bash
curl -k -u admin:pass https://localhost:8089/servicesNS/admin/search/directory
```

```xml
<feed xmlns="http://www.w3.org/2005/Atom" 
  xmlns:s="http://dev.splunk.com/ns/rest" 
  xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>directory</title>
  <id>https://localhost:8089/services/directory</id>
  <updated>2011-05-16T19:03:40-0700</updated>
  <generator version="98144"/>
  <author>
    <name>Splunk</name>
  </author>
  ... opensearch nodes elided ...
  <s:messages/>
  <entry>
    <title>_admin</title>
    <id>https://localhost:8089/servicesNS/nobody/system/data/ui/views/_admin</id>
    <updated>2011-05-16T19:03:40-0700</updated>
    <link href="/servicesNS/nobody/system/data/ui/views/_admin" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/system/data/ui/views/_admin" rel="list"/>
    <link href="/servicesNS/nobody/system/data/ui/views/_admin/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/system/data/ui/views/_admin" rel="edit"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        <s:key name="eai:type">views</s:key>
      </s:dict>
    </content>
  </entry>
  <entry>
    <title>abc</title>
    <id>https://localhost:8089/servicesNS/nobody/search/data/ui/views/abc</id>
    <updated>2011-05-16T19:03:40-0700</updated>
    <link href="/servicesNS/nobody/search/data/ui/views/abc" rel="alternate"/>
    <author>
      <name>ssorkin</name>
    </author>
    <link href="/servicesNS/nobody/search/data/ui/views/abc" rel="list"/>
    <link href="/servicesNS/nobody/search/data/ui/views/abc/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/search/data/ui/views/abc" rel="edit"/>
    <content type="text/xml">
      <s:dict>
        ... eai:acl node elided ...
        <s:key name="eai:type">views</s:key>
      </s:dict>
    </content>
  </entry>
</feed>
```

--------------------------------

### hello.py for Splunk Edge Hub OS

Source: https://help.splunk.com/en/splunk-cloud-platform/ot-intelligence/administer-splunk-edge-hub-os/2.2/configure-advanced-settings/use-docker-containers-with-splunk-edge-hub-os

Example Python script that prints 'hello, world' every 5 seconds with flush=True. This is used in the Docker image.

```python
from time import sleep

while True:
    print("hello, world", flush=True)
    sleep(5)
```

--------------------------------

### GET Duo-MFA configuration (XML response)

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/access-endpoints/access-endpoint-descriptions

Example XML response from the GET request, showing the configuration stanza and its settings.

```xml
<title>Duo-MFA</title> <id>https://localhost:8089/services/admin/Duo-MFA</id> <updated>2016-07-26T11:05:14-07:00</updated> <generator build="321df14f2b1047b51259ee2d4eeacb4184dc6679" version="20160720"/> <author> <name>Splunk</name> </author> <link href="/services/admin/Duo-MFA/\_new" rel="create"/> <link href="/services/admin/Duo-MFA/\_acl" rel="\_acl"/> <opensearch:totalResults>1</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> <entry> <title>duo-mfa</title> <id>https://localhost:8089/servicesNS/nobody/system/admin/Duo-MFA/duo-mfa</id> <updated>2016-07-26T11:05:14-07:00</updated> <link href="/servicesNS/nobody/system/admin/Duo-MFA/duo-mfa" rel="alternate"/> <author> <name>nobody</name> </author> <link href="/servicesNS/nobody/system/admin/Duo-MFA/duo-mfa" rel="list"/> <link href="/servicesNS/nobody/system/admin/Duo-MFA/duo-mfa" rel="edit"/> <link href="/servicesNS/nobody/system/admin/Duo-MFA/duo-mfa" rel="remove"/> <content type="text/xml"> <s:dict> <s:key name="apiHostname">api-cc7a8eab.duosecurity.com</s:key> <s:key name="appSecretKey">$1$cQdFd4+XlOrAfgBgQEwe+VevD/MOOfFTIA4vwoaFnCX0V0TO8ZsCsKQ=</s:key> <s:key name="eai:acl"> <s:dict> <s:key name="app">system</s:key> <s:key name="can\_change\_perms">1</s:key> <s:key name="can\_list">1</s:key> <s:key name="can\_share\_app">1</s:key> <s:key name="can\_share\_global">1</s:key> <s:key name="can\_share\_user">0</s:key> <s:key name="can\_write">1</s:key> <s:key name="modifiable">1</s:key> <s:key name="owner">nobody</s:key> <s:key name="perms"> <s:dict> <s:key name="read"> <s:list> <s:item>\*</s:item> </s:list> </s:key> <s:key name="write"> <s:list> <s:item>\*</s:item> </s:list> </s:key> </s:dict> </s:key> <s:key name="removable">0</s:key> <s:key name="sharing">system</s:key> </s:dict> </s:key> <s:key name="failOpen">0</s:key> <s:key name="integrationKey">$1$RHhrEPy965XhV3kSQmB/zyf6IZV/</s:key> <s:key name="secretKey">$1$A3t8AvuwwoDzSgUgB1x50FesOpd0ZKBWaHR5xY6uqWeaB02vsuFh4KQ=</s:key> <s:key name="sslCommonNameToCheck">\*.duosecurity.com</s:key> <s:key name="sslRootCAPath">/home/mkandaswamy/git/splunkApp/etc/auth/DigiCertHighAssuranceEVRootCA.pem</s:key> <s:key name="sslVerifyServerCert">true</s:key> <s:key name="sslVersions">tls1.2</s:key> <s:key name="timeout">5</s:key> <s:key name="useClientSSLCompression">true</s:key> </s:dict> </content> </entry>
```

--------------------------------

### Start etcd service with systemctl

Source: https://help.splunk.com/en/splunk-cloud-platform/connect-relational-databases/deploy-and-use-splunk-db-connect/4.1/configure-and-manage-splunk-db-connect/configure-high-availability-on-top-of-heavy-forwarders

Reloads systemd, enables etcd to start on boot, and starts the etcd service. Run these commands as root or with sudo.

```bash
$ sudo systemctl daemon-reload
$ sudo systemctl enable etcd
$ sudo systemctl start etcd
```

--------------------------------

### Example curl request to GET permissions

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/search-endpoints/search-endpoint-descriptions

Example request using curl to retrieve permissions for a module named my_module.

```json
curl -k -u <user>:<password> -X GET
https://localhost:8089/services/orchestrator/v1/spl2/modules/permissions \ 

                --data '{ 
                "resourceName": "my_module"   
                }'
```

--------------------------------

### Describe app response JSON

Source: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-config-service-manual/10.6/administer-splunk-cloud-platform-using-the-admin-config-service-acs-api/manage-splunkbase-apps-in-splunk-cloud-platform

Example JSON response for a specific app, showing fields like appID, label, name, splunkbaseID, status, and version. Status 'installed' indicates successful installation.

```json
{
   "appID": "SplunkforPaloAltoNetworks",
   "label": "Palo Alto Networks",
   "name": "SplunkforPaloAltoNetworks",
   "splunkbaseID": "491",
   "status": "installed",
   "version": "7.0.4"
}
```

--------------------------------

### frameWithoutInternalFields example

Source: https://help.splunk.com/en/splunk-cloud-platform/create-dashboards-and-reports/dashboard-studio/10.6/configuration-options-reference/dynamic-options-syntax-functions/dynamic-options-syntax-selector-functions

Removes all internal fields starting with an underscore from a DataFrame. Example removes fields like _time, _span, _raw.

```SPL
> primary | frameWithoutInternalFields()
```

```Result
[[2025-08-18, 2025-12-02...]],[[3655, 3615...],[91338, 72264...]]
```

--------------------------------

### GET /services/authorization/tokens - XML response

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/access-endpoints/access-endpoint-descriptions

Example XML response from the GET request, showing token details such as claims, headers, and status.

```xml
. . . <title>tokens</title> <id>https://splunkaday-linux-current:8089/services/authorization/tokens</id> <updated>2019-04-28T15:04:30-07:00</updated> <generator build="6c6f0a269b91" version="7.3.0"/> <author> <name>Splunk</name> </author> <link href="/services/authorization/tokens/\_new" rel="create"/> <opensearch:totalResults>1</opensearch:totalResults> <opensearch:itemsPerPage>30</opensearch:itemsPerPage> <opensearch:startIndex>0</opensearch:startIndex> <s:messages/> <entry> <title>60ccc93ef090ca6746cc56d5dd5c6c38359bcae2d0e8ddecc9dc3b21a93ad7f9</title> <id>https://splunkaday-linux-current:8089/services/authorization/tokens/60ccc93ef090ca6746cc56d5dd5c6c38359bcae2d0e8ddecc9dc3b21a93ad7f9</id> <updated>1969-12-31T16:00:00-08:00</updated> <link href="/services/authorization/tokens/60ccc93ef090ca6746cc56d5dd5c6c38359bcae2d0e8ddecc9dc3b21a93ad7f9" rel="alternate"/> <author> <name>system</name> </author> <link href="/services/authorization/tokens/60ccc93ef090ca6746cc56d5dd5c6c38359bcae2d0e8ddecc9dc3b21a93ad7f9" rel="list"/> <link href="/services/authorization/tokens/60ccc93ef090ca6746cc56d5dd5c6c38359bcae2d0e8ddecc9dc3b21a93ad7f9" rel="edit"/> <link href="/services/authorization/tokens/60ccc93ef090ca6746cc56d5dd5c6c38359bcae2d0e8ddecc9dc3b21a93ad7f9" rel="remove"/> <content type="text/xml"> <s:dict> <s:key name="claims"> <s:dict> <s:key name="aud">Tokentown</s:key> <s:key name="exp">0</s:key> <s:key name="iat">1556488991</s:key> <s:key name="idp">splunk</s:key> <s:key name="iss">admin from docs-unix-4</s:key> <s:key name="nbr">1556488991</s:key> <s:key name="roles"> <s:list> <s:item>\*</s:item> </s:list> </s:key> <s:key name="sub">admin</s:key> </s:dict> </s:key> <s:key name="eai:acl"> <s:dict> <s:key name="app"></s:key> <s:key name="can\_list">1</s:key> <s:key name="can\_write">1</s:key> <s:key name="modifiable">0</s:key> <s:key name="owner">system</s:key> <s:key name="perms"> <s:dict> <s:key name="read"> <s:list> <s:item>admin</s:item> <s:item>splunk-system-role</s:item> </s:list> </s:key> <s:key name="write"> <s:list> <s:item>admin</s:item> <s:item>splunk-system-role</s:item> </s:list> </s:key> </s:dict> </s:key> <s:key name="removable">0</s:key> <s:key name="sharing">system</s:key> </s:dict> </s:key> <s:key name="headers"> <s:dict> <s:key name="alg">HS512</s:key> <s:key name="kid">splunk.secret</s:key> <s:key name="ttyp">static</s:key> <s:key name="ver">v1</s:key> </s:dict> </s:key> <s:key name="lastUsed">0</s:key> <s:key name="lastUsedIp"></s:key> <s:key name="status">enabled</s:key> </s:dict> </content> </entry> </feed>
```

--------------------------------

### Install with --user and --group

Source: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/splunk-remote-upgrader-for-linux-universal-forwarders/10.6/reference/command-options

Provides an existing user and group to run the upgrader daemon. Cannot be used with --create-user.

```bash
./bin/install.sh --user <user> --group <group>
```

--------------------------------

### Start universal forwarder

Source: https://help.splunk.com/en/splunk-cloud-platform/forward-and-process-data/universal-forwarder-manual/10.4/install-the-universal-forwarder/install-a-nix-universal-forwarder

Starts the universal forwarder as root or sudo. Use the --accept-license flag to accept the license automatically.

```bash
sudo $SPLUNK_HOME/bin/splunk start
```

```bash
sudo $SPLUNK_HOME/bin/splunk start --accept-license
```

--------------------------------

### Kernel boot line with hugepages parameters

Source: https://help.splunk.com/en/splunk-cloud-platform/collect-stream-data/install-and-configure-splunk-stream/8.0/configure-your-splunk-stream-installation/configure-10gbps-network-capture

Example kernel boot line after adding parameters to configure sixteen 1GB hugepages. Edit /etc/grub.conf and add these parameters to the kernel boot line: default_hugepagesz=1G hugepagesz=1G hugepages=16. Reboot the machine after updating.

```text
kernel /vmlinuz-2.6.32-573.3.1.el6.x86_64 ro root=/dev/mapper/vg_cmload02-lv_root rd_LVM_LV=vg_cmload02/lv_root rd_NO_LUKS LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto rd_LVM_LV=vg_cmload02/lv_swap  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM default_hugepagesz=1G hugepagesz=1G hugepages=16 rhgb quiet
```

--------------------------------

### GET ProxySSO-auth response XML

Source: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.2.2510/access-endpoints/access-endpoint-descriptions

Example XML response from a GET request to /services/admin/ProxySSO-auth, showing the structure of a ProxySSO configuration entry.

```xml
...
  <title>ProxySSO-auth</title>
  <id>https://localhost:8089/services/admin/ProxySSO-auth</id>
  <updated>2016-08-31T15:57:42-07:00</updated>
  <generator build="ca6bc6de37c2" version="6.5.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/services/admin/ProxySSO-auth/_new" rel="create"/>
  <link href="/services/admin/ProxySSO-auth/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>my_proxy</title>
    <id>https://localhost:8089/services/admin/ProxySSO-auth/my_proxy</id>
    <updated>2016-08-31T15:57:42-07:00</updated>
    <link href="/services/admin/ProxySSO-auth/my_proxy" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/admin/ProxySSO-auth/my_proxy" rel="list"/>
    <link href="/services/admin/ProxySSO-auth/my_proxy" rel="edit"/>
    <link href="/services/admin/ProxySSO-auth/my_proxy" rel="remove"/>
    <link href="/services/admin/ProxySSO-auth/my_proxy/disable" rel="disable"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="blacklistedAutoMappedRoles">role1</s:key>
        <s:key name="blacklistedUsers"></s:key>
        <s:key name="defaultRoleIfMissing"></s:key>
        <s:key name="disabled">0</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>splunk-system-role</s:item>
                  </s:list>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
      </s:dict>
    </content>
  </entry>

...
```
Tokens:
Raw