Splunk Enterprise

https://docs.splunk.com/Documentation/Splunk/9.4.2/
Admin
Splunk Enterprise is a data platform that enables search, analysis, and visualization of...
Tokens:140,948
Snippets:700
Trust Score:10
Update:1 year ago
Show doc for...
Tokens:
Raw
### Splunk App Setup Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTapps

An example XML response from the Splunk API when requesting app setup information. It details app metadata and includes a CDATA section with detailed setup configurations for various scripts.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<SetupInfo>
 <block title="Welcome to the Splunk for nix App">
 <text>The Splunk for nix app provides some sample searches and reports to boot-strap your use of Splunk for Unix host management. To work, it needs certain inputs enabled. These system metrics drive the sample dashboards. Please review and confirm the inputs below before proceeding.</text>
 </block>
 <block title="CPU Stats (sar / mpstat / etc.)" endpoint="admin/script" entity=".%252Fbin%252Fcpu.sh">
 <input field="interval" id="/admin/script/.%252Fbin%252Fcpu.sh/interval">
 <label>Polling Interval (sec)</label>
 <type>text</type>
 </input>
 <input field="enabled" id="/admin/script/.%252Fbin%252Fcpu.sh/enabled">
 <label>Enable</label>
 <type>bool</type>
 </input>
 </block>

. . .

<block title="Time Query (date, ntpdate -q)" endpoint="admin/script" entity=".%252Fbin%252Ftime.sh">
 <input field="interval" id="/admin/script/.%252Fbin%252Ftime.sh/interval">
 <label>Polling Interval (sec)</label>
 <type>text</type>
 </input>
 <input field="enabled" id="/admin/script/.%252Fbin%252Ftime.sh/enabled">
 <label>Enable</label>
 <type>bool</type>
 </input>
 </block>
 <block title="Linux Audit Log (/var/log/audit/audit.log | ausearch)" endpoint="admin/script" entity=".%252Fbin%252Frlog.sh">
 <input field="interval" id="/admin/script/.%252Fbin%252Frlog.sh/interval">
 <label>Polling Interval (sec)</label>
 <type>text</type>
 </input>
 <input field="enabled" id="/admin/script/.%252Fbin%252Frlog.sh/enabled">
 <label>Enable</label>
 <type>bool</type>
 </input>
 </block>
 <block title="Warning">
 <text>Submitting this form can take a long time. Please be patient and wait for it to complete before navigating away from this page.</text>
 </block>
</SetupInfo>
```

--------------------------------

### Get Splunk App Setup Information

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTapps

Retrieves setup information for a specified Splunk app. This includes details about required setup scripts and their locations. The response contains CDATA with setup script details.

```bash
curl -k -u admin:changeme https://localhost:8089/services/apps/local/unix/setup
```

--------------------------------

### Splunk KV Store Migration Start Response

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTkvstore

Example XML response indicating that the Splunk KV Store migration has been successfully triggered.

```xml
.  <s:messages>                                                                                                                          
    <s:msg type="INFO">SHC KV Store migration has been successfully triggered</s:msg>                                                   
  </s:messages>
```

--------------------------------

### Manage Splunk Getting Started App

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTapps

Provides API links for managing the Splunk 'gettingstarted' app. Includes operations for listing, reloading, editing, removing, enabling, and packaging the app. Also shows configuration details like author and description.

```XML
<link href="/servicesNS/nobody/system/apps/local/gettingstarted" rel="list"/>
<link href="/servicesNS/nobody/system/apps/local/gettingstarted/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/system/apps/local/gettingstarted" rel="edit"/>
<link href="/servicesNS/nobody/system/apps/local/gettingstarted" rel="remove"/>
<link href="/servicesNS/nobody/system/apps/local/gettingstarted/enable" rel="enable"/>
<link href="/servicesNS/nobody/system/apps/local/gettingstarted/package" rel="package"/>
<s:key name="description">Get started with Splunk.  This app introduces you to many of Splunk's features.  You'll learn how to use Splunk to index data, search and investigate, add knowledge, monitor and alert, report and analyze.</s:key>
<s:key name="version">1.0</s:key>
```

--------------------------------

### Access Splunk App Setup Information

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTlist

This endpoint allows access to the setup information for a specific local Splunk application. It supports the GET method.

```Splunk API
GET /apps/local/{name}/setup
```

--------------------------------

### Get Splunk App Setup Information (REST API)

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTapps

Retrieves the setup information for a specified Splunk app. This endpoint is used to access configuration details related to an app's setup process.

```bash
https://<host>:<port>/services/apps/local/{name}/setup
```

--------------------------------

### Install Splunk App

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTlist

This endpoint facilitates the installation of Splunk applications from a URL or a local file. It supports the POST method for initiating the installation process.

```Splunk API
POST /apps/appinstall
```

--------------------------------

### Splunk TCP Create Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESToutput

An example XML response after creating a new Splunk TCP forwarder output. It typically confirms the operation and provides metadata about the created resource.

```xml
<title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:35:13-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
```

--------------------------------

### Splunk Deployment Server Configuration Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTdeploy

This is an example XML response from the Splunk API when querying deployment server configuration, specifically showing the 'disabled' status.

```xml
<entry>
   <title>default</title>
   <id>https://localhost:8089/services/deployment/server/config/default</id>
   <updated>2013-08-10T14:08:11-07:00</updated>
   <link href="/services/deployment/server/config/default" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/config/default" rel="list"/>
   <link href="/services/deployment/server/config/default/_reload" rel="_reload"/>
   <link href="/services/deployment/server/config/default" rel="edit"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="disabled">0</s:key>
     </s:dict>
   </content>
 </entry>
```

--------------------------------

### Splunk TCP Forwarder Server XML Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESToutput

An example of the XML response received when querying for Splunk TCP forwarder server information, detailing its configuration and status.

```xml
... 
 <title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:35:41-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 ...
```

--------------------------------

### Install Splunk App using REST API

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTapps

This snippet demonstrates how to install or update a Splunk application using the REST API. It requires authentication and specifies the app source file path or URL. The response includes installation status and location.

```bash
curl -k -u admin:changeme https://localhost:8089/services/apps/appinstall/ -d name=c:/tmp/splunk-dashboard-examples_50.tgz
```

```xml
.\n. \n. \n <title></title>\n <id>https://localhost:8089/services/apps/appinstall</id>\n <updated>2014-07-01T09:44:41-07:00</updated>\n <generator build="200839" version="6.1"/>\n <author>\n   <name>Splunk</name>\n </author>\n <link href="/services/apps/appinstall/_new" rel="create"/>\n <opensearch:totalResults>1</opensearch:totalResults>\n <opensearch:itemsPerPage>30</opensearch:itemsPerPage>\n <opensearch:startIndex>0</opensearch:startIndex>\n <s:messages/>\n <entry>\n   <title>dashboard_examples</title>\n   <id>https://localhost:8089/services/apps/appinstall/dashboard_examples</id>\n   <updated>2014-07-01T09:44:41-07:00</updated>\n   <link href="/services/apps/appinstall/dashboard_examples" rel="alternate"/>\n   <author>\n     <name>system</name>\n   </author>\n   <link href="/services/apps/appinstall/dashboard_examples" rel="list"/>\n   <content type="text/xml">\n     <s:dict>\n       <s:key name="eai:acl">\n         <s:dict>\n           <s:key name="app"></s:key>\n           <s:key name="can_list">1</s:key>\n           <s:key name="can_write">1</s:key>\n           <s:key name="modifiable">0</s:key>\n           <s:key name="owner">system</s:key>\n           <s:key name="perms">\n             <s:dict>\n               <s:key name="read">\n                 <s:list>\n                   <s:item>*</s:item>\n                 </s:list>\n               </s:key>\n               <s:key name="write">\n                 <s:list>\n                   <s:item>admin</s:item>\n                   <s:item>splunk-system-role</s:item>\n                 </s:list>\n               </s:key>\n             </s:dict>\n           </s:key>\n           <s:key name="removable">0</s:key>\n           <s:key name="sharing">system</s:key>\n         </s:dict>\n       </s:key>\n       <s:key name="location">C:\\Program Files\\Splunk\\etc\\apps\\dashboard_examples</s:key>\n       <s:key name="name">dashboard_examples</s:key>\n       <s:key name="source_location">c:/tmp/splunk-dashboard-examples_50.tgz</s:key>\n       <s:key name="status">installed</s:key>\n     </s:dict>\n   </content>\n </entry>
```

--------------------------------

### Splunk Deployment Server Client Response (XML)

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTdeploy

This snippet shows an example XML response from the Splunk deployment server API after a client operation. It includes details about the client, such as its GUID, IP address, and last phone home time.

```xml
<title>serverclients</title>
 <id>https://qa-sv-rh61x64-7:8103/services/deployment/server/clients</id>
 <updated>2013-10-21T16:03:49-07:00</updated>
 <generator build="182785" version="6.0"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/deployment/server/clients/countClients_by_machineType" rel="countClients_by_machineType"/>
 <link href="/services/deployment/server/clients/countRecentDownloads" rel="countRecentDownloads"/>
 <link href="/services/deployment/server/clients/getMatchingAppsForClient_dryRun" rel="getMatchingAppsForClient_dryRun"/>
 <link href="/services/deployment/server/clients/preview" rel="preview"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>149685cb3e39898fbd15be6604672a31</title>
   <id>https://qa-sv-rh61x64-7:8103/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31</id>
   <updated>2013-10-21T16:03:49-07:00</updated>
   <link href="/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31" rel="list"/>
   <link href="/services/deployment/server/clients/149685cb3e39898fbd15be6604672a31" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="averagePhoneHomeInterval">60</s:key>
       <s:key name="build">177748</s:key>
       <s:key name="clientName">4D4EA12E-FDBA-41D3-99CD-2A61CC1DAB29</s:key>
       <s:key name="dns">qa-sv-rh61x64-10.sv.splunk.com</s:key>
       ... eai:acl node elided ...
       <s:key name="guid">149685cb3e39898fbd15be6604672a31</s:key>
       <s:key name="hostname">qa-sv-rh61x64-10</s:key>
       <s:key name="id">connection_10.160.24.224_8097_qa-sv-rh61x64-10.sv.splunk.com_qa-sv-rh61x64-10_4D4EA12E-FDBA-41D3-99CD-2A61CC1DAB29</s:key>
       <s:key name="ip">10.160.24.224</s:key>
       <s:key name="lastPhoneHomeTime">1382396628</s:key>
       <s:key name="mgmt">8097</s:key>
       <s:key name="name">4D4EA12E-FDBA-41D3-99CD-2A61CC1DAB29</s:key>
       <s:key name="serverClasses"/>
       <s:key name="utsname">linux-x86_64</s:key>
     </s:dict>
   </content>
 </entry>
 . . . elided ...
```

--------------------------------

### Start KV Store Migration (Splunk API)

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTkvstore

Initiates the migration of the KV store storage engine in a Splunk deployment. This API call is used to start the migration process.

```bash
https://<host>:<mPort>/services/shcluster/captain/kvmigrate/start
```

--------------------------------

### List Splunk Apps (Bash)

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTapps

This snippet demonstrates how to use `curl` to make a GET request to the Splunk REST API to retrieve a list of locally installed applications. It includes authentication and the target endpoint.

```bash
curl -k -u admin:changeme https://localhost:8089/services/apps/local
```

--------------------------------

### Splunk Distributed Search Configuration Response

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTdeploy

An example XML response detailing the configuration of a Splunk distributed search setup. It shows various key-value pairs representing settings like server timeouts, enabled status, and peer management options.

```xml
<entry>
   <title>distributedSearch</title>
   <id>https://localhost:8089/services/search/distributed/config/distributedSearch</id>
   <updated>2011-07-10T23:21:51-07:00</updated>
   <link href="/services/search/distributed/config/distributedSearch" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/search/distributed/config/distributedSearch" rel="list"/>
   <link href="/services/search/distributed/config/distributedSearch" rel="edit"/>
   <link href="/services/search/distributed/config/distributedSearch" rel="remove"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="autoAddServers">0</s:key>
       <s:key name="blacklistNames"/>
       <s:key name="blacklistURLs"/>
       <s:key name="checkTimedOutServersFrequency">60</s:key>
       <s:key name="disabled">0</s:key>
       <s:key name="dist_search_enabled">1</s:key>
       <s:key name="heartbeatFrequency">0</s:key>
       <s:key name="heartbeatMcastAddr">224.0.0.37</s:key>
       <s:key name="heartbeatPort">8888</s:key>
       <s:key name="removedTimedOutServers">0</s:key>
       <s:key name="serverTimeout">10</s:key>
       <s:key name="servers"/>
       <s:key name="shareBundles">1</s:key>
       <s:key name="skipOurselves">0</s:key>
       <s:key name="statusTimeout">10</s:key>
       <s:key name="ttl">1</s:key>
     </s:dict>
   </content>
 </entry>
```

--------------------------------

### KV Store Version Upgrade Status Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTkvstore

This is an example XML response when checking the status of a KV store version upgrade. It includes details about the storage engine, upgrade status, and version.

```xml
<content type="text/xml">
            <s:dict>
                <s:key name="eai:acl">
                    <s:dict>
                        <s:key name="app"></s:key>
                        <s:key name="can_list">1</s:key>
                        <s:key name="can_write">1</s:key>
                        <s:key name="modifiable">0</s:key>
                        <s:key name="owner">system</s:key>
                        <s:key name="perms">
                            <s:dict>
                                <s:key name="read">
                                    <s:list>
                                        <s:item>admin</s:item>
                                        <s:item>splunk-system-role</s:item>
                                        <s:item>splunk_system_upgrader</s:item>
                                    </s:list>
                                </s:key>
                                <s:key name="write">
                                    <s:list>
                                        <s:item>admin</s:item>
                                        <s:item>splunk-system-role</s:item>
                                    </s:list>
                                </s:key>
                            </s:dict>
                        </s:key>
                        <s:key name="removable">0</s:key>
                        <s:key name="sharing">system</s:key>
                    </s:dict>
                </s:key>
                <s:key name="status">
                    <s:dict>
                        <s:key name="storageEngine">wiredTiger</s:key>
                        <s:key name="upgradeStatus">1</s:key>
                        <s:key name="version">4.2.25</s:key>
                    </s:dict>
                </s:key>
            </s:dict>
        </content>
```

--------------------------------

### Install Splunk App on Deployment Clients

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTdeploy

This snippet details the installation of Splunk applications on deployment clients. It specifies the archive file path, restart behavior for Splunk Web and Splunkd, and the server classes to which the application is applied. The state on the client is 'enabled'.

```XML
<s:dict>
               <s:key name="action">Install</s:key>
               <s:key name="archive">/opt/cluster/peer1/splunk/var/run/tmp/sc_new/wma-app2-1375305443.bundle</s:key>
               <s:key name="restartSplunkWeb">0</s:key>
               <s:key name="restartSplunkd">0</s:key>
               <s:key name="result">Ok</s:key>
               <s:key name="serverclasses">
                 <s:list>
                   <s:item>sc_mach_type</s:item>
                   <s:item>sc_new</s:item>
                   <s:item>sc_apps_wma</s:item>
                 </s:list>
               </s:key>
               <s:key name="size">112640</s:key>
               <s:key name="stateOnClient">enabled</s:key>
               <s:key name="timestamp">Wed Jul 31 14:11:23 2013</s:key>
             </s:dict>
```

--------------------------------

### Splunk TCP Server Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESToutput

An example XML response when listing Splunk TCP forwarded servers. It shows the structure of the returned data, including server details and links for further actions.

```xml
<title>tcpout-server</title>
 <id>https://localhost:8089/services/data/outputs/tcp/server</id>
 <updated>2011-07-10T21:34:59-07:00</updated>
 <generator version="102807"/>
 <author>
   <name>Splunk</name>
 </author>
 <link href="/services/data/outputs/tcp/server/_new" rel="create"/>
 <link href="/services/data/outputs/tcp/server/_reload" rel="_reload"/>
 ... opensearch nodes elided ...
 <s:messages/>
 <entry>
   <title>spacecake:9998</title>
   <id>https://localhost:8089/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998</id>
   <updated>2011-07-10T21:34:59-07:00</updated>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="list"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998/_reload" rel="_reload"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="edit"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998" rel="remove"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998/allconnections" rel="allconnections"/>
   <link href="/servicesNS/nobody/system/data/outputs/tcp/server/spacecake%3A9998/disable" rel="disable"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="destHost">spacecake.splunk.com</s:key>
       <s:key name="destIp">10.1.1.73</s:key>
       <s:key name="destPort">9998</s:key>
       <s:key name="disabled">0</s:key>
       ... eai:acl nodes elided ...
       <s:key name="method">autobalance</s:key>
       <s:key name="sourcePort">8085</s:key>
       <s:key name="status">connect_fail</s:key>
     </s:dict>
   </content>
 </entry>
```

--------------------------------

### Splunk Knowledge Bundle Replication Cycles Response

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTdeploy

Example XML response detailing Splunk knowledge bundle replication cycles. Includes metadata like title, ID, and updated time, along with detailed content for each replication cycle, such as bundle ID, paths, replication start time, cycle ID, and peer status.

```XML
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>bundle-replication-cycles</title>
  <id>https://qa-centos7x64-056:8089/services/search/distributed/bundle/replication/cycles</id>
  <updated>2019-08-23T16:32:20-07:00</updated>
  <generator build="9f02da632403" version="8.0.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>80CC124B-2D46-44A7-95C2-A92ECC32C050</title>
    <id>https://qa-centos7x64-056:8089/services/search/distributed/bundle/replication/cycles/80CC124B-2D46-44A7-95C2-A92ECC32C050</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
    <link href="/services/search/distributed/bundle/replication/cycles/80CC124B-2D46-44A7-95C2-A92ECC32C050" rel="alternate"/>
    <author>
      <name>system</name>
    </author>
    <link href="/services/search/distributed/bundle/replication/cycles/80CC124B-2D46-44A7-95C2-A92ECC32C050" rel="list"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="bundle_id">qa-centos7x64-056-1566601784</s:key>
        <s:key name="current_bundle">/root/splunk_install/var/run/qa-centos7x64-056-1566601784.bundle</s:key>
        <s:key name="current_repl_start_time">1566602286</s:key>
        <s:key name="cycle_id">80CC124B-2D46-44A7-95C2-A92ECC32C050</s:key>
        <s:key name="delta_path">/root/splunk_install/var/run/qa-centos7x64-056-1566601708-1566601784.delta</s:key>
        <s:key name="eai:acl">
          <s:dict>
            <s:key name="app"></s:key>
            <s:key name="can_list">1</s:key>
            <s:key name="can_write">1</s:key>
            <s:key name="modifiable">0</s:key>
            <s:key name="owner">system</s:key>
            <s:key name="perms">
              <s:dict>
                <s:key name="read">
                  <s:list>
                    <s:item>admin</s:item>
                    <s:item>power</s:item>
                    <s:item>splunk-system-role</s:item>
                    <s:item>user</s:item>
                  </s:list>
                </s:key>
                <s:key name="write">
                  <s:list/>
                </s:key>
              </s:dict>
            </s:key>
            <s:key name="removable">0</s:key>
            <s:key name="sharing">system</s:key>
          </s:dict>
        </s:key>
        <s:key name="is_repl_in_progress">0</s:key>
        <s:key name="peers_status">
          <s:dict>
            <s:key name="https://10.140.126.37:8089">
              <s:dict>
                <s:key name="classic_replication_state">succeeded</s:key>
                <s:key name="peer_name">https://10.140.126.37:8089</s:key>
              </s:dict>
            </s:key>
            <s:key name="https://10.140.127.113:8089">
              <s:dict>
                <s:key name="classic_replication_state">succeeded</s:key>
                <s:key name="peer_name">https://10.140.127.113:8089</s:key>
              </s:dict>
            </s:key>
            <s:key name="https://10.140.127.79:8089">
              <s:dict>
                <s:key name="classic_replication_state">succeeded</s:key>
                <s:key name="peer_name">https://10.140.127.79:8089</s:key>
              </s:dict>
            </s:key>
          </s:dict>
        </s:key>
        <s:key name="replicationPolicy">classic</s:key>
      </s:dict>
    </content>
  </entry>
</feed>
```

--------------------------------

### Splunk KV Store OR Query Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTkvstore

A JSON query example for Splunk KV Store to find events authored by either 'userA' or 'userB'.

```json
{ "$or": [ { "author": "userA" }, { "author": "userB" } ] }
```

--------------------------------

### Splunk License Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTlicense

An example of the XML response received after adding or accessing a Splunk license. The response includes various attributes of the license such as its ID, creation and expiration times, enabled features, quota, status, and more.

```xml
<title>licenses</title>
<id>https://localhost:8089/services/licenser/licenses</id>
<updated>2011-07-11T09:41:32-07:00</updated>
<generator version="102824"/>
<author>
  <name>Splunk</name>
</author>
<link href="/services/licenser/licenses/_new" rel="create"/>
<s:messages/>
<entry>
  <title>CF6C50 ... elided ...72CE6C</title>
  <id>https://localhost:8089/services/licenser/licenses/CF6C50 ... elided ...72CE6C</id>
  <updated>2011-07-11T09:41:32-07:00</updated>
  <link href="/services/licenser/licenses/CF6C50 ... elided ...72CE6C" rel="alternate"/>
  <author>
    <name>system</name>
  </author>
  <link href="/services/licenser/licenses/CF6C50 ... elided ...72CE6C" rel="list"/>
  <link href="/services/licenser/licenses/CF6C50 ... elided ...72CE6C" rel="remove"/>
  <content type="text/xml">
    <s:dict>
      <s:key name="creation_time">1306168427</s:key>
      <s:key name="expiration_time">2147483647</s:key>
      <s:key name="features">
        <s:list>
          <s:item>Auth</s:item>
          <s:item>FwdData</s:item>
          <s:item>RcvData</s:item>
          <s:item>LocalSearch</s:item>
          <s:item>DistSearch</s:item>
          <s:item>RcvSearch</s:item>
          <s:item>ScheduledSearch</s:item>
          <s:item>Alerting</s:item>
          <s:item>DeployClient</s:item>
          <s:item>DeployServer</s:item>
          <s:item>SplunkWeb</s:item>
          <s:item>SigningProcessor</s:item>
          <s:item>SyslogOutputProcessor</s:item>
          <s:item>CanBeRemoteManager</s:item>
        </s:list>
      </s:key>
      <s:key name="group_id">Enterprise</s:key>
      <s:key name="label">Splunk Enterprise</s:key>
      <s:key name="license_hash">CF6C50 ... elided ...72CE6C</s:key>
      <s:key name="max_violations">5</s:key>
      <s:key name="quota">10737418240</s:key>
      <s:key name="sourcetypes">
        <s:list/>
      </s:key>
      <s:key name="stack_id">enterprise</s:key>
      <s:key name="status">VALID</s:key>
      <s:key name="type">enterprise</s:key>
      <s:key name="window_period">30</s:key>
    </s:dict>
  </content>
</entry>
```

--------------------------------

### Splunk License Peer Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTlicense

An example XML response from the Splunk API when listing license peers. It details the structure of the returned data, including peer IDs, labels, pool memberships, stack memberships, and warning counts.

```xml
<title>peers</title>
 <id>https://localhost:8089/services/licenser/peers</id>
 <updated>2011-05-17T09:37:54-07:00</updated>
 <generator version="99849"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>74A43C7E-C33C-41F6-B027-E603D2C3FE68</title>
   <id>https://localhost:8089/servicesNS/nobody/system/licenser/peers/74A43C7E-C33C-41F6-B027-E603D2C3FE68</id>
   <updated>2011-05-17T09:37:54-07:00</updated>
   <link href="/servicesNS/nobody/system/licenser/peers/74A43C7E-C33C-41F6-B027-E603D2C3FE68" rel="alternate"/>
   <author>
     <name>nobody</name>
   </author>
   <link href="/servicesNS/nobody/system/licenser/peers/74A43C7E-C33C-41F6-B027-E603D2C3FE68" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         <s:dict>
           <s:key name="app">system</s:key>
           <s:key name="can_write">1</s:key>
             <s:key name="modifiable">0</s:key>
           <s:key name="owner">nobody</s:key>
           <s:key name="perms">
             <s:dict>
               <s:key name="read">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
               <s:key name="write">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="sharing">system</s:key>
         </s:dict>
       </s:key>
       <s:key name="label">thething-vishalp</s:key>
       <s:key name="pool_ids">
         <s:list>
           <s:item>auto_generated_pool_enterprise</s:item>
           <s:item>auto_generated_pool_forwarder</s:item>
           <s:item>auto_generated_pool_free</s:item>
         </s:list>
       </s:key>
       <s:key name="stack_ids">
         <s:list>
           <s:item>enterprise</s:item>
           <s:item>forwarder</s:item>
           <s:item>free</s:item>
         </s:list>
       </s:key>
       <s:key name="warning_count">0</s:key>
     </s:dict>
   </content>
 </entry>
```

--------------------------------

### Federated Search Settings Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTfederated

An example XML response structure for the federated search settings API, illustrating the returned data fields and their typical values.

```xml
<entry>
    <title>general</title>
    <id>https://localhost:8089/servicesNS/nobody/system/data/federated/settings/general</id>
    <updated>1969-12-31T16:00:00-08:00</updated>
```

--------------------------------

### Splunk App Template XML Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTapps

An example XML response for retrieving a Splunk app template descriptor. It contains metadata such as title, ID, update time, and detailed content including ACLs and attributes.

```xml
.\n. .\n. \n <title></title>\n <id>https://localhost:8089/services/apps/apptemplates</id>\n <updated>2014-07-01T09:54:23-07:00</updated>\n <generator build="200839" version="6.1"/>\n <author>\n   <name>Splunk</name>\n </author>\n <opensearch:totalResults>1</opensearch:totalResults>\n <opensearch:itemsPerPage>30</opensearch:itemsPerPage>\n <opensearch:startIndex>0</opensearch:startIndex>\n <s:messages/>\n <entry>\n   <title>sample_app</title>\n   <id>https://localhost:8089/services/apps/apptemplates/sample_app</id>\n   <updated>2014-07-01T09:54:23-07:00</updated>\n   <link href="/services/apps/apptemplates/sample_app" rel="alternate"/>\n   <author>\n     <name>system</name>\n   </author>\n   <link href="/services/apps/apptemplates/sample_app" rel="list"/>\n   <content type="text/xml">\n     <s:dict>\n       <s:key name="eai:acl">\n         <s:dict>\n           <s:key name="app"></s:key>\n           <s:key name="can_list">1</s:key>\n           <s:key name="can_write">1</s:key>\n           <s:key name="modifiable">0</s:key>\n           <s:key name="owner">system</s:key>\n           <s:key name="perms">\n             <s:dict>\n               <s:key name="read">\n                 <s:list>\n                   <s:item>admin</s:item>\n                   <s:item>splunk-system-role</s:item>\n                 </s:list>\n               </s:key>\n               <s:key name="write">\n                 <s:list>\n                   <s:item>*</s:item>\n                 </s:list>\n               </s:key>\n             </s:dict>\n           </s:key>\n           <s:key name="removable">0</s:key>\n           <s:key name="sharing">system</s:key>\n         </s:dict>\n       </s:key>\n       <s:key name="eai:attributes">\n         <s:dict>\n           <s:key name="optionalFields">\n             <s:list/>\n           </s:key>\n           <s:key name="requiredFields">\n             <s:list/>\n           </s:key>\n           <s:key name="wildcardFields">\n             <s:list/>\n           </s:key>\n         </s:dict>\n       </s:key>\n       <s:key name="lol">wut</s:key>\n     </s:dict>\n   </content>\n </entry>
```

--------------------------------

### Splunk Licenser Messages API Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTlicense

An example of the XML response when querying the Splunk licenser messages endpoint. It includes details about message categories, creation times, descriptions, and severity levels.

```xml
<entry>
  <title>70a19a5cfe6d7c2a678089638dee7bea</title>
  <id>https://localhost:8089/services/licenser/messages/70a19a5cfe6d7c2a678089638dee7bea</id>
  <updated>2011-08-02T03:50:46-07:00</updated>
  <link href="/services/licenser/messages/70a19a5cfe6d7c2a678089638dee7bea" rel="alternate"/>
  <author>
    <name>system</name>
  </author>
  <link href="/services/licenser/messages/70a19a5cfe6d7c2a678089638dee7bea" rel="list"/>
  <content type="text/xml">
    <s:dict>
      <s:key name="category">pool_warning_count</s:key>
      <s:key name="create_time">1312282230</s:key>
      <s:key name="description">This pool contains peer(s) with 3 warnings</s:key>
      <s:key name="pool_id"/>
      <s:key name="severity">WARN</s:key>
      <s:key name="peer_id"/>
      <s:key name="stack_id"/>
    </s:dict>
  </content>
</entry>
```

--------------------------------

### Splunk License Stack XML Response Example

Source: https://docs.splunk.com/Documentation/Splunk/9.4.2/RESTREF/RESTlicense

An example XML response detailing a Splunk license stack. It includes information such as the stack's label, byte quota, and type. The response structure is part of the Splunk REST API.

```xml
<title>stacks</title>
 <id>https://localhost:8089/services/licenser/stacks</id>
 <updated>2011-07-08T10:42:44-07:00</updated>
 <generator version="102824"/>
 <author>
   <name>Splunk</name>
 </author>
 <opensearch:totalResults>1</opensearch:totalResults>
 <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
 <opensearch:startIndex>0</opensearch:startIndex>
 <s:messages/>
 <entry>
   <title>enterprise</title>
   <id>https://localhost:8089/services/licenser/stacks/enterprise</id>
   <updated>2011-07-08T10:42:44-07:00</updated>
   <link href="/services/licenser/stacks/enterprise" rel="alternate"/>
   <author>
     <name>system</name>
   </author>
   <link href="/services/licenser/stacks/enterprise" rel="list"/>
   <content type="text/xml">
     <s:dict>
       <s:key name="eai:acl">
         <s:dict>
           <s:key name="app"></s:key>
           <s:key name="can_write">1</s:key>
           <s:key name="modifiable">0</s:key>
           <s:key name="owner">system</s:key>
           <s:key name="perms">
             <s:dict>
               <s:key name="read">
                 <s:list>
                   <s:item>admin</s:item>
                   </s:list>
               </s:key>
               <s:key name="write">
                 <s:list>
                   <s:item>admin</s:item>
                 </s:list>
               </s:key>
             </s:dict>
           </s:key>
           <s:key name="sharing">system</s:key>
         </s:dict>
       </s:key>
       <s:key name="eai:attributes"> ... elided ...</s:key>
       <s:key name="label">Splunk Internal License</s:key>
       <s:key name="quota">10737418240</s:key>
       <s:key name="type">enterprise</s:key>
     </s:dict>
   </content>
 </entry>
```
Tokens:
Raw