Splunk Enterprise

https://help.splunk.com/en/splunk-enterprise
Admin
Splunk Enterprise is an on-premises data platform for collecting, indexing, and visualizing data to...
Tokens:12,216,000
Snippets:64,702
Trust Score:10
Update:1 day ago
Show doc for...
Tokens:
Raw
### Version output example

Source: https://help.splunk.com/en/splunk-enterprise/splunk-pod-guide/10.4/upgrade-splunk-pod

Example output from the version command, showing the Kubernetes Installer version (2.0.0) and Splunk Enterprise version (10.4.2).

```text
Version: 2.0.0
Splunk Version: 10.4.2
```

--------------------------------

### Example 1: Match all clients and include all apps

Source: https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/10.6/configure-the-agent-management-system/set-up-agent-filters

Configures a global whitelist to match all clients and a server class that encapsulates all apps in the repository location.

```ini
# Example 1
# Match all clients and includ all apps in the server class

[global]
whitelist.0=*
# whitelist matches all clients.
[serverClass:AllApps]
[serverClass:AllApps:app:*]
# a server class that encapsulates all apps in the repositoryLocation 
```

--------------------------------

### curl request for node-identity/{guid}

Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/topology-endpoints/topology-endpoint-descriptions

Example curl command to make a GET request to the node-identity/{guid} endpoint. Uses -k to skip certificate verification and -u for basic authentication.

```json
curl -k -u admin:<password> \
  https://127.0.0.1:<port>/services/stack-explainer/v1/node-identity/{guid}
```

--------------------------------

### GET request for app setup information using curl

Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/application-endpoints/application-endpoint-descriptions

Example curl command to retrieve setup information for the 'unix' app. Uses basic authentication with admin:changeme and the localhost:8089 endpoint.

```bash
curl -k -u admin:changeme https://localhost:8089/services/apps/local/unix/setup
```

--------------------------------

### viewstates.conf.example - Example configuration

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.6/configuration-file-reference/10.6.1-configuration-file-reference/viewstates.conf

Example viewstates.conf file. Shows sample stanzas for charting, global, and dashboard views with various settings. Includes a link to configuration file documentation.

```plaintext
#   Version 10.6.1.1
#
# This is an example viewstates.conf.
#
# To learn more about configuration files (including precedence) please see
# the documentation located at
# http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

[charting:g3b5fa7l]
ChartTypeFormatter_0_7_0.default = area
Count_0_6_0.count = 10
LegendFormatter_0_13_0.default = right
LineMarkerFormatter_0_10_0.default = false
NullValueFormatter_0_12_0.default = gaps

[*:g3jck9ey]
Count_0_7_1.count = 20
DataOverlay_0_12_0.dataOverlayMode = none
DataOverlay_1_13_0.dataOverlayMode = none
FieldPicker_0_6_1.fields = host sourcetype source date_hour date_mday date_minute date_month
FieldPicker_0_6_1.sidebarDisplay = True
FlashTimeline_0_5_0.annotationSearch = search index=twink
FlashTimeline_0_5_0.enableAnnotations = true
FlashTimeline_0_5_0.minimized = false
MaxLines_0_13_0.maxLines = 10
RowNumbers_0_12_0.displayRowNumbers = true
RowNumbers_1_11_0.displayRowNumbers = true
RowNumbers_2_12_0.displayRowNumbers = true
Segmentation_0_14_0.segmentation = full
SoftWrap_0_11_0.enable = true

[dashboard:_current]
TimeRangePicker_0_1_0.selected = All time
```

--------------------------------

### setup.xml.conf.spec example

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.6/configuration-file-reference/10.6.0-configuration-file-reference/setup.xml.conf

Example setup.xml configuration showing a block with inputs for a saved search, including a bulk update input. The spec notes that setup XML is not supported in Splunk Cloud or with search head clustering, and that blocks cannot be nested.

```xml
<setup>
  <block title="Basic stuff" endpoint="saved/searches/" entity="foobar">
    <text> some description here </text>

    <input field="is_scheduled">
      <label>Enable Schedule for $name$</label>   <!-- this will be rendered as "Enable Schedule for foobar" -->
      <type>bool</type>
    </input>

    <input field="cron_scheduled">
      <label>Cron Schedule</label>
      <type>text</type>
    </input>
    <input field="actions">
      <label>Select Active Actions</label>
      <type>list</type>
    </input>

    <!-- bulk update  -->
    <input entity="*" field="is_scheduled" mode="bulk">
      <label>Enable Schedule For All</label>
      <type>bool</type>
    </input>
  </block>
</setup>
```

--------------------------------

### XML response for GET rollup summaries

Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/metrics-catalog-endpoints/metrics-catalog-endpoint-descriptions

Example XML response from the GET request, showing rollup summary details including span, rollupIndex, aggregation, dimensionList, and metricList. The response is truncated with '...' at the start.

```xml
... <entry> <title>index\_s</title> <id>https://127.0.0.1:8101/servicesNS/nobody/search/catalog/metricstore/rollup/index\_s</id> <updated>1969-12-31T16:00:00-08:00</updated> <link href="/servicesNS/nobody/search/catalog/metricstore/rollup/index\_s" rel="alternate"/> <author> <name>nobody</name> </author> <link href="/servicesNS/nobody/search/catalog/metricstore/rollup/index\_s" rel="list"/> <link href="/servicesNS/nobody/search/catalog/metricstore/rollup/index\_s/\_reload" rel="\_reload"/> <link href="/servicesNS/nobody/search/catalog/metricstore/rollup/index\_s" rel="edit"/> <link href="/servicesNS/nobody/search/catalog/metricstore/rollup/index\_s" rel="remove"/> <link href="/servicesNS/nobody/search/catalog/metricstore/rollup/index\_s/disable" rel="disable"/> <content type="text/xml"> <s:dict> <s:key name="aggregation.foo1">min#avg</s:key> <s:key name="aggregation.foo2">count#avg</s:key> <s:key name="defaultAggregation">avg#max</s:key> <s:key name="dimensionList">app,region</s:key> <s:key name="dimensionListType">included</s:key> <s:key name="disabled">0</s:key> <s:key name="eai:acl"> <s:dict> <s:key name="app">search</s:key> <s:key name="can\_change\_perms">1</s:key> <s:key name="can\_list">1</s:key> <s:key name="can\_share\_app">1</s:key> <s:key name="can\_share\_global">1</s:key> <s:key name="can\_share\_user">0</s:key> <s:key name="can\_write">1</s:key> <s:key name="modifiable">1</s:key> <s:key name="owner">nobody</s:key> <s:key name="perms"/> <s:key name="removable">0</s:key> <s:key name="sharing">system</s:key> </s:dict> </s:key> <s:key name="metricList">foo3,foo4</s:key> <s:key name="metricListType">excluded</s:key> <s:key name="minSpanAllowed">300</s:key> <s:key name="summaries"> <s:dict> <s:key name="0"> <s:dict> <s:key name="rollupIndex">index\_d\_1h</s:key> <s:key name="span">1h</s:key> </s:dict> </s:key> <s:key name="1"> <s:dict> <s:key name="rollupIndex">index\_d\_1d</s:key> <s:key name="span">1d</s:key> </s:dict> </s:key> </s:dict> </s:key> </s:dict> </content> </entry> </feed>
```

--------------------------------

### Example output of splunk rolling-restart -status 1

Source: https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.6/manage-search-head-clustering/restart-the-search-head-cluster

Example output showing the status of cluster members during a rolling restart. Each row lists the peer name, status (RESTARTING or RESTART-COMPLETE), start time, end time, and GUID.

```text
Peer | Status | Start Time | End Time | GUID 
1. server-centos65x64-4 | RESTARTING | Mon Apr 20 11:52:21 2015 | N/A | 7F10190D-F00A-47AF-8688-8DD26F1A8A4D
2. server-centos65x64-3 | RESTART-COMPLETE | Mon Apr 20 11:51:54 2015 | Mon Apr 20 11:52:16 2015 | E78F5ECF-1EC0-4E51-9EF7-5939B793763C
```

--------------------------------

### server.conf.example full configuration

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/server.conf

Complete example server.conf file with commented sections for general settings, SSL, proxy, SSO, cascading replication, clustering, config change tracker, HTTP listener, and queue settings. Copy desired blocks into $SPLUNK_HOME/etc/system/local/server.conf and restart Splunk to apply.

```ini
#   Version 10.2.0
#
# This file contains an example server.conf.  Use this file to configure SSL
# and HTTP server options.
#
# To use one or more of these configurations, copy the configuration block
# into server.conf in $SPLUNK_HOME/etc/system/local/. You must restart
# Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see
# the documentation located at
# http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

# Allow users 8 hours before they time out
[general]
sessionTimeout=8h
pass4SymmKey = changeme

# Listen on IPv6 in addition to IPv4...
listenOnIPv6 = yes
# ...but make all outgoing TCP connections on IPv4 exclusively
connectUsingIpVersion = 4-only

# Turn on SSL:

[sslConfig]
enableSplunkdSSL = true
useClientSSLCompression = true
serverCert = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
certCreateScript = genMyServerCert.sh

[dataplaneSslConfig]
serverCertDataplane = $SPLUNK_HOME/etc/auth/server_dp.pem
certDPCreateScript = genMyDPServerCert.sh

[proxyConfig]
http_proxy = http://proxy:80
https_proxy = http://proxy:80
proxy_rules = *
no_proxy = localhost, 127.0.0.1, ::1

######## SSO Example ########
# This example trusts all logins from the splunk web server and localhost
# Note that a proxy to the splunk web server should exist to enforce
# authentication
[general]
trustedIP = 127.0.0.1

####### Cascading Replication Example ######
[cascading_replication]
pass4SymmKey = someSecret
max_replication_threads = auto
max_replication_jobs = 5
cascade_replication_plan_reap_interval = 1h
cascade_replication_plan_age = 8h
cascade_replication_plan_fanout = auto
cascade_replication_plan_topology = size_balanced
cascade_replication_plan_select_policy = random


############################################################################
# Set this node to be a cluster manager.
############################################################################


[clustering]
mode = manager
replication_factor = 3
pass4SymmKey = someSecret
search_factor = 2


############################################################################
# Set this node to be a peer to cluster manager "SplunkManager01" on port
# 8089.
############################################################################

[clustering]
mode = peer 
manager_uri = https://SplunkManager01.example.com:8089
pass4SymmKey = someSecret

############################################################################
# Set this node to be a searchhead to cluster manager "SplunkManager01" on
# port 8089.
############################################################################
[clustering]
mode = searchhead
manager_uri = https://SplunkManager01.example.com:8089
pass4SymmKey = someSecret

############################################################################
# Set this node to be a searchhead to multiple cluster managers -
# "SplunkManager01" with pass4SymmKey set to 'someSecret and "SplunkManager02"
# with no pass4SymmKey set here.
############################################################################
[clustering]
mode = searchhead
manager_uri = clustermanager:east, clustermanager:west

[clustermanager:east]
manager_uri = https://SplunkManager01.example.com:8089
pass4SymmKey=someSecret

[clustermanager:west]
manager_uri = https://SplunkManager02.example.com:8089

############################################################################
#     Configuration file change tracker
#  To enable the feature, set 'disabled=false'.
#  Set 'mode=auto' to include all available features.
###############################################################################
[config_change_tracker]
disabled = false
mode = auto
denylist=peer-apps|savedsearches\.conf$
exclude_fields = server.conf:general:pass4SymmKey, authentication.conf:authentication:*
 
############################################################################
# Open an additional non-SSL HTTP REST port, bound to the localhost
# interface (and therefore not accessible from outside the machine)  Local
# REST clients like the CLI can use this to avoid SSL overhead when not
# sending data across the network.
############################################################################
[httpServerListener:127.0.0.1:8090]
ssl = false


############################################################################
# Set modinput facing exec queue to 16MB.
############################################################################
[queue=execProcessorInternalQ]
maxSize = 16384KB

      
```

--------------------------------

### curl request for cluster/manager/generation/manager

Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/cluster-endpoints/cluster-endpoint-descriptions

Example curl command to GET peer node information for the 'manager' search head GUID. Uses -k to skip certificate verification and -u for basic authentication.

```bash
curl -k -u admin:pass https://localhost:8089/services/cluster/manager/generation/manager
```

--------------------------------

### wmi.conf.example

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.6/configuration-file-reference/10.6.1-configuration-file-reference/wmi.conf

Example wmi.conf file with settings for runtime parameters, event log collection, performance metrics, and event notification queries. Copy the configuration block into wmi.conf in $SPLUNK_HOME\etc\system\local\ and restart Splunk to enable.

```ini
#   Version 10.6.1.1
#
# This is an example wmi.conf.  These settings are used to control inputs
# from WMI providers. Refer to wmi.conf.spec and the documentation at
# splunk.com for more information about this file.
#
# To use one or more of these configurations, copy the configuration block
# into wmi.conf in $SPLUNK_HOME\etc\system\local\.  You must restart Splunk
# to enable configurations.
#
# To learn more about configuration files (including precedence) please see
# the documentation located at
# http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

# This stanza specifies runtime parameters.

[settings]
initial_backoff = 5
max_backoff = 20
max_retries_at_max_backoff = 2
checkpoint_sync_interval = 2

# Pull events from the Application, System and Security event logs from the
# local system every 10 seconds. Store the events in the "wmi_eventlog"
# Splunk index.

[WMI:LocalApplication]
interval = 10
event_log_file = Application
disabled = 0
index = wmi_eventlog

[WMI:LocalSystem]
interval = 10
event_log_file = System
disabled = 0
index = wmi_eventlog

[WMI:LocalSecurity]
interval = 10
event_log_file = Security
disabled = 0
index = wmi_eventlog

# Gather disk and memory performance metrics from the local system every
# second.  Store event in the "wmi_perfmon" Splunk index.

[WMI:LocalPhysicalDisk]
interval = 1
wql = select Name, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk
disabled = 0
index = wmi_perfmon

[WMI:LocalMainMemory]
interval = 10
wql = select CommittedBytes, AvailableBytes, PercentCommittedBytesInUse, Caption from Win32_PerfFormattedData_PerfOS_Memory
disabled = 0
index = wmi_perfmon

# Collect all process-related performance metrics for the splunkd process,
# every second.  Store those events in the "wmi_perfmon" index.
[WMI:LocalSplunkdProcess]
interval = 1
wql = select * from Win32_PerfFormattedData_PerfProc_Process where Name = "splunkd"
disabled = 0
index = wmi_perfmon

# Listen from three event log channels, capturing log events that occur only
# while Splunk is running, every 10 seconds.  Gather data from three remote
# servers srv1, srv2 and srv3.

[WMI:TailApplicationLogs]
interval = 10
event_log_file = Application, Security, System
server = srv1, srv2, srv3
disabled = 0
current_only = 1
batch_size = 10

# Listen for process-creation events on a remote machine, once a second.

[WMI:ProcessCreation]
interval = 1
server = remote-machine
wql = select * from __InstanceCreationEvent within 1 where TargetInstance isa 'Win32_Process'
disabled = 0
current_only = 1
batch_size = 10

# Receive events whenever someone connects or removes a USB device on
# the computer, once a second.

[WMI:USBChanges]
interval = 1
wql = select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'
disabled = 0
current_only = 1
batch_size = 10
```

--------------------------------

### inputs.conf.example - Full Example Configuration

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.6/configuration-file-reference/10.6.1-configuration-file-reference/inputs.conf

Complete example inputs.conf file with commented configuration blocks for various data inputs. Copy desired blocks to $SPLUNK_HOME/etc/system/local/inputs.conf and restart Splunk to apply. Includes monitor, TCP, Splunk TCP, SSL, Windows Event Log, and performance monitoring stanzas.

```ini
#   Version 10.6.1.1
#
# This is an example inputs.conf. Use this file to configure data inputs.
#
# To use one or more of these configurations, copy the configuration block into
# inputs.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to
# enable configurations.
#
# To learn more about configuration files (including precedence) please see the
# documentation located at
# http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles


# The following configuration reads all the files in the directory /var/log.

[monitor:///var/log]


# The following configuration reads all the files under /var/log/httpd and
# classifies them as sourcetype::access_common.
#
# When checking a file for new data, if the file's modification time is from
# before seven days ago, the file will no longer be checked for changes
# until you restart the software.

[monitor:///var/log/httpd]
sourcetype = access_common
ignoreOlderThan = 7d


# The following configuration reads all the
# files under /mnt/logs. When the path is /mnt/logs/<host>/... it
# sets the hostname (by file) to <host>.

[monitor:///mnt/logs]
host_segment = 3


# The following configuration listens on TCP port 9997 for raw
# data from ANY remote server (not just a Splunk instance). The host of the
# data is set to the IP address of the remote server.

[tcp://9997]


# The following configuration listens on TCP port 9995 for raw
# data from ANY remote server. The host of the data is set as the host name of
# the remote server.  All data will also be assigned the sourcetype "log4j" and
# the source "tcp:9995".

[tcp://9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995


# The following configuration listens on TCP port 9995 for raw
# data from 10.1.1.10.
# All data is assigned the host "webhead-1", the sourcetype "access_common" and
# the the source "//10.1.1.10/var/log/apache/access.log".

[tcp://192.0.2.10:9995]
host = webhead-1
sourcetype = access_common
source = //192.0.2.10/var/log/apache/access.log


# The following configuration listens on TCP port 9996 for
# Splunk cooked event data from ANY splunk forwarder.
# The host of the data is set to the host name of the remote server ONLY IF the
# remote data has no host set, or if it is set to "localhost".

[splunktcp://9996]
connection_host = dns


# The following configuration listens on TCP port 9996 for
# distributed search data from 10.1.1.100. The data is processed the same as
# locally indexed data.

[splunktcp://10.1.1.100:9996]


# The following configuration listens on TCP port 514 for data
# from syslog.corp.company.net. The data is assigned the sourcetype "syslog"
# and the host is set to the host name of the remote server.

[tcp://syslog.corp.example.net:514]
sourcetype = syslog
connection_host = dns

# Following configuration limits the acceptance of data to forwarders
# that have been configured with the token value specified in 'token' field.
# NOTE: The token value is encrypted. The REST endpoint encrypts the token
# while saving it.

[splunktcptoken://tok1]
token = $8$AAAAAAAAAAAAAAAAAAAAAA==$ifQTPTzHD/BA8VgKvVcgO1KQAtr3N1C8S/1uK3nAKIE9dd9e9g==

# Set up Secure Sockets Layer (SSL):

[SSL]
serverCert=$SPLUNK_HOME/etc/auth/server.pem
password=password
requireClientCert=false

[splunktcp-ssl:9996]

# Use file system change monitor:

[fschange:/etc/]
fullEvent=true
pollPeriod=60
recurse=true
sendEventMaxSize=100000
index=main

# Monitor the Security Windows Event Log channel, getting the most recent
# events first, then older, and finally continuing to gather newly arriving events

[WinEventLog://Security]
disabled = 0
start_from = newest
evt_dc_name =
evt_dns_name =
evt_resolve_ad_ds =
evt_resolve_ad_obj = 1
checkpointInterval = 5

# Monitor the ForwardedEvents Windows Event Log channel, only gathering the
# events that arrive after monitoring starts, going forward in time.

[WinEventLog://ForwardedEvents]
disabled = 0
start_from = oldest
current_only = 1
batch_size = 10
checkpointInterval = 5

[tcp://9994]
queueSize=50KB
persistentQueueSize=100MB

# Perfmon: Windows performance monitoring examples

# You must specify the names of objects, counters and instances
# exactly as they are shown in the Performance Monitor application. Splunk Web
# is the recommended interface to use to configure performance monitor inputs.

# These stanzas gather performance data from the local system only.
# Use wmi.conf for performance monitor metrics on remote systems.

# Query the PhysicalDisk performance object and gather disk access data for
# all physical drives installed in the system. Store this data in the
# "perfmon" index.

[perfmon://LocalPhysicalDisk]
interval = 10
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = PerfMon

```

--------------------------------

### Successful trusted-connections response

Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/topology-endpoints/topology-endpoint-descriptions

Example JSON response for a successful GET request. Contains header timestamp, node GUID, HEC configuration, S2S details, TCP/UDP inputs, and search peers.

```json
{
  "header": { "timestamp": "2026-04-08T05:36:08Z" },
  "guid": "89773DD4-A41C-406F-9CC2-6FCB54E08C73",
  "hec": {
    "enabled": true,
    "port": 8088,
    "hashed_tokens": ["e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],
    "senders": ["10.0.1.5", "10.0.1.6"]
  },
  "s2s": {
    "receiving_ports": { "9997": ["10.0.1.10", "10.0.1.11"] },
    "forwarding_hosts": ["downstream-indexer.example.com:9997"]
  },
  "tcp_inputs": { "5114": ["10.0.1.20"] },
  "udp_inputs": { "5115": ["10.0.1.21"] },
  "searchPeers": [
    { "name": "indexer-1.example.com:8089", "guid": "8D98B2F4-3385-4AAF-89B0-634FE60AF26A" }
  ]
}
```

--------------------------------

### serverclass.seed.xml.conf.example

Source: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.6/configuration-file-reference/10.6.1-configuration-file-reference/serverclass.seed.xml.conf

Example configuration file for serverclass.seed.xml.conf. Demonstrates multiple server classes with app definitions, repository locations, and endpoints. Shows how to specify local file endpoints and URL patterns for downloading apps.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<deployment name="root">
  <serverClass name="spacecake_apps">
    <app name="app_0">
      <repositoryLocation>$SPLUNK_HOME/etc/myapps</repositoryLocation>
      <!-- Download app_0 from the given location -->
      <endpoint>splunk.com/spacecake/apps/app_0.tgz</endpoint>
    </app>
    <app name="app_1">
      <repositoryLocation>$SPLUNK_HOME/etc/myapps</repositoryLocation>
      <!-- Download app_1 from the given location -->
      <endpoint>splunk.com/spacecake/apps/app_1.tgz</endpoint>
    </app>
  </serverClass>
  <serverClass name="foobar_apps">
    <!-- construct url for each location based on the scheme below and download each app -->
    <endpoint>foobar.com:5556/services/streams/deployment?name=$serverClassName$_$appName$.bundle</endpoint>
    <app name="app_0"/>
    <app name="app_1"/>
    <app name="app_2"/>
  </serverClass>
  <serverClass name="local_apps">
    <endpoint>foo</endpoint>
    <app name="app_0">
      <!-- app present in local filesystem -->
      <endpoint>file:/home/johndoe/splunk/ds/service_class_2_app_0.bundle</endpoint>
    </app>
    <app name="app_1">
      <!-- app present in local filesystem -->
      <endpoint>file:/home/johndoe/splunk/ds/service_class_2_app_1.bundle</endpoint>
    </app>
    <app name="app_2">
      <!-- app present in local filesystem -->
      <endpoint>file:/home/johndoe/splunk/ds/service_class_2_app_2.bundle</endpoint>
    </app>
  </serverClass>
</deployment>
```

--------------------------------

### GET response example

Source: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/configuration-endpoints/configuration-endpoint-descriptions

Example response body for the GET request, showing the plaintext value 'True'.

```text
True
```

--------------------------------

### agent_management.conf with 10-minute timeouts

Source: https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/10.6/troubleshooting/troubleshoot-timeout-errors

Example configuration for $SPLUNK_HOME/etc/system/local/agent_management.conf that sets request_timeout to 10m in both the [general] and [splunkd_client] stanzas. Use this as a starting point for larger setups; adjust values based on your environment and monitor results.

```ini
[general]
request_timeout = 10m

[splunkd_client]
request_timeout = 10m
```
Tokens:
Raw