{ "info": { "_postman_id": "db199be7-6e3e-422c-a6e0-67a11de5c90d", "name": "Splunk Enterprise REST API", "description": "The Splunk Enterprise REST API provides programmatic access to Splunk Enterprise functionality including search, indexing, data inputs, and system management. All requests are made over HTTPS to the splunkd management port (default 8089). Authentication is required via Splunk authentication tokens or HTTP Basic authentication with a valid Splunk username and password. Responses are available in JSON and XML formats.\n\nContact Support:\n Name: Splunk Inc.\n Email: devinfo@splunk.com", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "lastUpdatedBy": "35240", "uid": "35240-db199be7-6e3e-422c-a6e0-67a11de5c90d" }, "item": [ { "name": "services", "item": [ { "name": "search", "item": [ { "name": "jobs", "item": [ { "name": "{search_id}", "item": [ { "name": "control", "item": [ { "name": "Control a Search Job", "id": "8a35ef6a-d54a-405c-a415-92f1f43b4908", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The control action to execute", "key": "action", "value": "setttl" }, { "description": "Time to live in seconds (used with setttl action)", "key": "ttl", "value": "" }, { "description": "Priority value 0-10 (used with setpriority action)", "key": "priority", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/control?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "control" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "id": "e9b34974-fa1d-4f76-ae59-180078b31d96", "key": "search_id", "value": "", "description": "(Required) The search ID (sid) of the search job" } ] }, "description": "Execute a control action on a search job such as pause, unpause, finalize, cancel, or touch (extend the job lifetime)." }, "response": [ { "id": "ae62451e-6728-4911-a2a0-af6ac40d5e0c", "name": "Control action executed successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The control action to execute", "key": "action", "value": "setttl" }, { "description": "Time to live in seconds (used with setttl action)", "key": "ttl", "value": "" }, { "description": "Priority value 0-10 (used with setpriority action)", "key": "priority", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/control?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "control" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "search_id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-ae62451e-6728-4911-a2a0-af6ac40d5e0c" }, { "id": "f06a9318-ebba-4560-bc79-380951450da6", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The control action to execute", "key": "action", "value": "setttl" }, { "description": "Time to live in seconds (used with setttl action)", "key": "ttl", "value": "" }, { "description": "Priority value 0-10 (used with setpriority action)", "key": "priority", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/control?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "control" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-f06a9318-ebba-4560-bc79-380951450da6" }, { "id": "e1911bc0-29f9-48f4-ad6a-8bbdea3a006f", "name": "The requested resource was not found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The control action to execute", "key": "action", "value": "setttl" }, { "description": "Time to live in seconds (used with setttl action)", "key": "ttl", "value": "" }, { "description": "Priority value 0-10 (used with setpriority action)", "key": "priority", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/control?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "control" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-e1911bc0-29f9-48f4-ad6a-8bbdea3a006f" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-8a35ef6a-d54a-405c-a415-92f1f43b4908" } ], "id": "28f8090b-87f0-41a5-bb42-4cc6069ae401", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-28f8090b-87f0-41a5-bb42-4cc6069ae401" }, { "name": "results", "item": [ { "name": "Get Search Results", "id": "778122cf-d344-4c90-b469-1199fd2f6a1c", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/results?output_mode=xml&count=30&offset=0&search=&field_list=", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "results" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Post-processing search string to filter results", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" } ], "variable": [ { "id": "8c2156b3-c0a5-4e4f-a3f8-814a1aa27481", "key": "search_id", "value": "", "description": "(Required) The search ID (sid) of the search job" } ] }, "description": "Returns the results of a completed search job. Results are available only after the search job has finished. Use the count and offset parameters for pagination." }, "response": [ { "id": "a6c76d08-f7d6-4ed9-85e0-2756dfdc502f", "name": "Search results returned successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/results?output_mode=xml&count=30&offset=0&search=&field_list=", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "results" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Post-processing search string to filter results", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" } ], "variable": [ { "key": "search_id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"init_offset\": \"\",\n \"results\": [\n {\n \"ute\": true,\n \"culpa_34e\": 30822542.966494694,\n \"consequat_a\": 64267571\n },\n {\n \"Duis_c47\": -14464023.525075167\n }\n ],\n \"fields\": [\n {\n \"name\": \"\",\n \"type\": \"\"\n },\n {\n \"name\": \"\",\n \"type\": \"\"\n }\n ],\n \"messages\": [\n {\n \"type\": \"\",\n \"text\": \"\"\n },\n {\n \"type\": \"\",\n \"text\": \"\"\n }\n ],\n \"preview\": \"\",\n \"highlighted\": {}\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a6c76d08-f7d6-4ed9-85e0-2756dfdc502f" }, { "id": "1a8d6082-f74b-4a79-a91a-e39068a96de8", "name": "Search job has not yet finished; no results available", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/results?output_mode=xml&count=30&offset=0&search=&field_list=", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "results" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Post-processing search string to filter results", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" } ], "variable": [ { "key": "search_id" } ] } }, "status": "No Content", "code": 204, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-1a8d6082-f74b-4a79-a91a-e39068a96de8" }, { "id": "bf938057-6e83-4d98-bbc0-6261484620a8", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/results?output_mode=xml&count=30&offset=0&search=&field_list=", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "results" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Post-processing search string to filter results", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-bf938057-6e83-4d98-bbc0-6261484620a8" }, { "id": "1a5229d7-4a10-465a-85ce-f105305cf80d", "name": "The requested resource was not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/results?output_mode=xml&count=30&offset=0&search=&field_list=", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "results" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Post-processing search string to filter results", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-1a5229d7-4a10-465a-85ce-f105305cf80d" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-778122cf-d344-4c90-b469-1199fd2f6a1c" } ], "id": "0fb2f079-1cdf-497e-8beb-c3ef51c49253", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-0fb2f079-1cdf-497e-8beb-c3ef51c49253" }, { "name": "events", "item": [ { "name": "Get Search Events", "id": "ab2cf0bf-6c5e-487b-8b8a-84ef14dbc2d8", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/events?output_mode=xml&count=30&offset=0&earliest_time=&latest_time=&search=&field_list=&truncation_mode=abstract&max_lines=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "events" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Earliest time boundary for events", "key": "earliest_time", "value": "" }, { "description": "Latest time boundary for events", "key": "latest_time", "value": "" }, { "description": "Post-processing search to filter events", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" }, { "description": "How to truncate long lines", "key": "truncation_mode", "value": "abstract" }, { "description": "Maximum number of lines per event", "key": "max_lines", "value": "0" } ], "variable": [ { "id": "84c3ca02-4b1e-4b4d-aee5-8fa4592e87b9", "key": "search_id", "value": "", "description": "(Required) The search ID (sid) of the search job" } ] }, "description": "Returns the untransformed events of a search job. Unlike results, events return the raw data before any transforming commands are applied. Available for searches that include non-transforming commands." }, "response": [ { "id": "aaa58f08-4815-4172-901d-e6691f6f8982", "name": "Search events returned successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/events?output_mode=xml&count=30&offset=0&earliest_time=&latest_time=&search=&field_list=&truncation_mode=abstract&max_lines=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "events" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Earliest time boundary for events", "key": "earliest_time", "value": "" }, { "description": "Latest time boundary for events", "key": "latest_time", "value": "" }, { "description": "Post-processing search to filter events", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" }, { "description": "How to truncate long lines", "key": "truncation_mode", "value": "abstract" }, { "description": "Maximum number of lines per event", "key": "max_lines", "value": "0" } ], "variable": [ { "key": "search_id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"init_offset\": \"\",\n \"results\": [\n {\n \"ute\": true,\n \"culpa_34e\": 30822542.966494694,\n \"consequat_a\": 64267571\n },\n {\n \"Duis_c47\": -14464023.525075167\n }\n ],\n \"fields\": [\n {\n \"name\": \"\",\n \"type\": \"\"\n },\n {\n \"name\": \"\",\n \"type\": \"\"\n }\n ],\n \"messages\": [\n {\n \"type\": \"\",\n \"text\": \"\"\n },\n {\n \"type\": \"\",\n \"text\": \"\"\n }\n ],\n \"preview\": \"\",\n \"highlighted\": {}\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-aaa58f08-4815-4172-901d-e6691f6f8982" }, { "id": "a32f0b97-111f-4587-a128-d9eda3418ab2", "name": "No events available yet", "originalRequest": { "method": "GET", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/events?output_mode=xml&count=30&offset=0&earliest_time=&latest_time=&search=&field_list=&truncation_mode=abstract&max_lines=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "events" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Earliest time boundary for events", "key": "earliest_time", "value": "" }, { "description": "Latest time boundary for events", "key": "latest_time", "value": "" }, { "description": "Post-processing search to filter events", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" }, { "description": "How to truncate long lines", "key": "truncation_mode", "value": "abstract" }, { "description": "Maximum number of lines per event", "key": "max_lines", "value": "0" } ], "variable": [ { "key": "search_id" } ] } }, "status": "No Content", "code": 204, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a32f0b97-111f-4587-a128-d9eda3418ab2" }, { "id": "a0e01bed-41c3-4b5e-a6fc-832f1448fc32", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/events?output_mode=xml&count=30&offset=0&earliest_time=&latest_time=&search=&field_list=&truncation_mode=abstract&max_lines=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "events" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Earliest time boundary for events", "key": "earliest_time", "value": "" }, { "description": "Latest time boundary for events", "key": "latest_time", "value": "" }, { "description": "Post-processing search to filter events", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" }, { "description": "How to truncate long lines", "key": "truncation_mode", "value": "abstract" }, { "description": "Maximum number of lines per event", "key": "max_lines", "value": "0" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a0e01bed-41c3-4b5e-a6fc-832f1448fc32" }, { "id": "4907f0cb-548e-43c6-8be7-a883dca49cc7", "name": "The requested resource was not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id/events?output_mode=xml&count=30&offset=0&earliest_time=&latest_time=&search=&field_list=&truncation_mode=abstract&max_lines=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id", "events" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Earliest time boundary for events", "key": "earliest_time", "value": "" }, { "description": "Latest time boundary for events", "key": "latest_time", "value": "" }, { "description": "Post-processing search to filter events", "key": "search", "value": "" }, { "description": "Comma-separated list of fields to return", "key": "field_list", "value": "" }, { "description": "How to truncate long lines", "key": "truncation_mode", "value": "abstract" }, { "description": "Maximum number of lines per event", "key": "max_lines", "value": "0" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-4907f0cb-548e-43c6-8be7-a883dca49cc7" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-ab2cf0bf-6c5e-487b-8b8a-84ef14dbc2d8" } ], "id": "1373e920-2fa7-454c-b8fe-3499027fe7e5", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-1373e920-2fa7-454c-b8fe-3499027fe7e5" }, { "name": "Get Search Job Details", "id": "77a088ac-6c47-4883-b1a1-89a8e0c5f5c9", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "id": "3193c25e-243f-4453-82cf-dc4e93a98065", "key": "search_id", "value": "", "description": "(Required) The search ID (sid) of the search job" } ] }, "description": "Returns detailed information about a specific search job including its status, progress, performance metrics, and configuration." }, "response": [ { "id": "24d02208-314a-443f-a69b-3a93b427922e", "name": "Search job details returned successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "search_id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"sid\": \"\",\n \"content\": {\n \"sid\": \"\",\n \"dispatchState\": \"FINALIZING\",\n \"doneProgress\": \"\",\n \"scanCount\": \"\",\n \"eventCount\": \"\",\n \"resultCount\": \"\",\n \"runDuration\": \"\",\n \"earliestTime\": \"\",\n \"latestTime\": \"\",\n \"cursorTime\": \"\",\n \"eventSearch\": \"\",\n \"reportSearch\": \"\",\n \"isSaved\": \"\",\n \"isFinalized\": \"\",\n \"isPaused\": \"\",\n \"isZombie\": \"\",\n \"isDone\": \"\",\n \"isFailed\": \"\",\n \"isPreviewEnabled\": \"\",\n \"isRealTimeSearch\": \"\",\n \"isSavedSearch\": \"\",\n \"isRemoteTimeline\": \"\",\n \"priority\": \"\",\n \"ttl\": \"\",\n \"request\": {},\n \"performance\": {},\n \"messages\": [\n {\n \"type\": \"FATAL\",\n \"text\": \"\"\n },\n {\n \"type\": \"FATAL\",\n \"text\": \"\"\n }\n ]\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-24d02208-314a-443f-a69b-3a93b427922e" }, { "id": "41789598-e717-46b3-a3e2-5d3cab909c9d", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-41789598-e717-46b3-a3e2-5d3cab909c9d" }, { "id": "57dacd98-8c26-4a5d-a29e-3356237442e3", "name": "The requested resource was not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "search_id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-57dacd98-8c26-4a5d-a29e-3356237442e3" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-77a088ac-6c47-4883-b1a1-89a8e0c5f5c9" }, { "name": "Delete a Search Job", "id": "4b4e5645-b2ca-4429-9243-ce9e393aa0bb", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "variable": [ { "id": "f8a6a2b7-4487-43ac-9a52-c831c0ca6a2d", "key": "search_id", "value": "", "description": "(Required) The search ID (sid) of the search job" } ] }, "description": "Cancels and deletes the specified search job and its results." }, "response": [ { "id": "3b999ac5-0900-4f7c-8340-8fe509dc349e", "name": "Search job deleted successfully", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "variable": [ { "key": "search_id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-3b999ac5-0900-4f7c-8340-8fe509dc349e" }, { "id": "7820e066-79a0-4177-a916-de2bfb500b11", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "variable": [ { "key": "search_id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-7820e066-79a0-4177-a916-de2bfb500b11" }, { "id": "bd8b7317-13f1-42af-af20-234938c90c9c", "name": "The requested resource was not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/:search_id", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", ":search_id" ], "variable": [ { "key": "search_id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-bd8b7317-13f1-42af-af20-234938c90c9c" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-4b4e5645-b2ca-4429-9243-ce9e393aa0bb" } ], "id": "dcaba48a-b570-4525-9373-1077dda6c19a", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-dcaba48a-b570-4525-9373-1077dda6c19a" }, { "name": "export", "item": [ { "name": "Export Search Results", "id": "a4ddab43-bf6f-4029-a42a-5be47d20163d", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/export?search=&output_mode=xml&earliest_time=&latest_time=&auto_cancel=&enable_lookups=true", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", "export" ], "query": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Earliest time for the search", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "Seconds of inactivity after which the search is cancelled", "key": "auto_cancel", "value": "" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" } ] }, "description": "Runs a search and streams results back as they become available, rather than waiting for the search to complete. This is a streaming endpoint suitable for long-running searches or real-time searches. The search runs synchronously and results stream back in the response." }, "response": [ { "id": "d68902f0-01c9-436a-a15c-39e850271dca", "name": "Search results streaming successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/export?search=&output_mode=xml&earliest_time=&latest_time=&auto_cancel=&enable_lookups=true", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", "export" ], "query": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Earliest time for the search", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "Seconds of inactivity after which the search is cancelled", "key": "auto_cancel", "value": "" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"init_offset\": \"\",\n \"results\": [\n {\n \"ute\": true,\n \"culpa_34e\": 30822542.966494694,\n \"consequat_a\": 64267571\n },\n {\n \"Duis_c47\": -14464023.525075167\n }\n ],\n \"fields\": [\n {\n \"name\": \"\",\n \"type\": \"\"\n },\n {\n \"name\": \"\",\n \"type\": \"\"\n }\n ],\n \"messages\": [\n {\n \"type\": \"\",\n \"text\": \"\"\n },\n {\n \"type\": \"\",\n \"text\": \"\"\n }\n ],\n \"preview\": \"\",\n \"highlighted\": {}\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d68902f0-01c9-436a-a15c-39e850271dca" }, { "id": "768de878-168d-420d-93b3-93f6b9a10790", "name": "The request is malformed or contains invalid parameters", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/export?search=&output_mode=xml&earliest_time=&latest_time=&auto_cancel=&enable_lookups=true", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", "export" ], "query": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Earliest time for the search", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "Seconds of inactivity after which the search is cancelled", "key": "auto_cancel", "value": "" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-768de878-168d-420d-93b3-93f6b9a10790" }, { "id": "c816cef8-786a-480e-a8e1-a29a961f8444", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs/export?search=&output_mode=xml&earliest_time=&latest_time=&auto_cancel=&enable_lookups=true", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs", "export" ], "query": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Earliest time for the search", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "Seconds of inactivity after which the search is cancelled", "key": "auto_cancel", "value": "" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-c816cef8-786a-480e-a8e1-a29a961f8444" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a4ddab43-bf6f-4029-a42a-5be47d20163d" } ], "id": "3f5995bf-5c21-4166-89c3-34e726c6d875", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-3f5995bf-5c21-4166-89c3-34e726c6d875" }, { "name": "List Search Jobs", "id": "4e92dcf0-589a-4b57-8fe0-7c5b62fc58be", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml&count=30&offset=0&search=&sort_key=dispatch_time&sort_dir=desc", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter search jobs by search string", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "dispatch_time" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" } ] }, "description": "Returns a list of current search jobs for the authenticated user. Includes job status, progress, and metadata for each job." }, "response": [ { "id": "8d6e10e1-d8d6-4ce0-8b21-79aac7c5042b", "name": "List of search jobs returned successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml&count=30&offset=0&search=&sort_key=dispatch_time&sort_dir=desc", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter search jobs by search string", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "dispatch_time" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"origin\": \"\",\n \"updated\": \"\",\n \"generator\": {\n \"build\": \"\",\n \"version\": \"\"\n },\n \"entry\": [\n {\n \"sid\": \"\",\n \"content\": {\n \"sid\": \"\",\n \"dispatchState\": \"PAUSED\",\n \"doneProgress\": \"\",\n \"scanCount\": \"\",\n \"eventCount\": \"\",\n \"resultCount\": \"\",\n \"runDuration\": \"\",\n \"earliestTime\": \"\",\n \"latestTime\": \"\",\n \"cursorTime\": \"\",\n \"eventSearch\": \"\",\n \"reportSearch\": \"\",\n \"isSaved\": \"\",\n \"isFinalized\": \"\",\n \"isPaused\": \"\",\n \"isZombie\": \"\",\n \"isDone\": \"\",\n \"isFailed\": \"\",\n \"isPreviewEnabled\": \"\",\n \"isRealTimeSearch\": \"\",\n \"isSavedSearch\": \"\",\n \"isRemoteTimeline\": \"\",\n \"priority\": \"\",\n \"ttl\": \"\",\n \"request\": {},\n \"performance\": {},\n \"messages\": [\n {\n \"type\": \"FATAL\",\n \"text\": \"\"\n },\n {\n \"type\": \"FATAL\",\n \"text\": \"\"\n }\n ]\n }\n },\n {\n \"sid\": \"\",\n \"content\": {\n \"sid\": \"\",\n \"dispatchState\": \"PARSING\",\n \"doneProgress\": \"\",\n \"scanCount\": \"\",\n \"eventCount\": \"\",\n \"resultCount\": \"\",\n \"runDuration\": \"\",\n \"earliestTime\": \"\",\n \"latestTime\": \"\",\n \"cursorTime\": \"\",\n \"eventSearch\": \"\",\n \"reportSearch\": \"\",\n \"isSaved\": \"\",\n \"isFinalized\": \"\",\n \"isPaused\": \"\",\n \"isZombie\": \"\",\n \"isDone\": \"\",\n \"isFailed\": \"\",\n \"isPreviewEnabled\": \"\",\n \"isRealTimeSearch\": \"\",\n \"isSavedSearch\": \"\",\n \"isRemoteTimeline\": \"\",\n \"priority\": \"\",\n \"ttl\": \"\",\n \"request\": {},\n \"performance\": {},\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n }\n }\n ],\n \"paging\": {\n \"total\": \"\",\n \"perPage\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-8d6e10e1-d8d6-4ce0-8b21-79aac7c5042b" }, { "id": "a476089d-5137-425a-aefd-d0ea5db78c84", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml&count=30&offset=0&search=&sort_key=dispatch_time&sort_dir=desc", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter search jobs by search string", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "dispatch_time" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a476089d-5137-425a-aefd-d0ea5db78c84" }, { "id": "cbb41003-adba-436c-ad93-4d796a9d3052", "name": "The authenticated user does not have permission to perform this operation", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml&count=30&offset=0&search=&sort_key=dispatch_time&sort_dir=desc", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter search jobs by search string", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "dispatch_time" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-cbb41003-adba-436c-ad93-4d796a9d3052" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-4e92dcf0-589a-4b57-8fe0-7c5b62fc58be" }, { "name": "Create a Search Job", "id": "0b7adfdb-abc7-4c67-9a29-c2bc481e44cd", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Earliest time for the search using relative or absolute time format", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "The search mode", "key": "search_mode", "value": "normal" }, { "description": "Execution mode. Normal runs asynchronously, oneshot runs synchronously, blocking waits for completion.", "key": "exec_mode", "value": "normal" }, { "description": "Maximum number of results to return", "key": "max_count", "value": "10000" }, { "description": "Maximum time in seconds before the search is finalized", "key": "max_time", "value": "0" }, { "description": "Number of seconds to keep the search after processing has stopped", "key": "timeout", "value": "86400" }, { "description": "Comma-separated list of required fields to include in results", "key": "rf", "value": "" }, { "description": "Application namespace for the search", "key": "namespace", "value": "" }, { "description": "Optional custom search ID. If not specified, Splunk generates one automatically.", "key": "id", "value": "" }, { "description": "Number of status buckets to generate for the search timeline. Set to a value greater than 0 to enable timeline.", "key": "status_buckets", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically cancelled. 0 means never auto-cancel.", "key": "auto_cancel", "value": "0" }, { "description": "Auto-finalize the search after this number of events have been processed. 0 disables auto-finalize.", "key": "auto_finalize_ec", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically paused. 0 means never auto-pause.", "key": "auto_pause", "value": "0" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" }, { "description": "Whether to reload macro definitions before the search", "key": "reload_macros", "value": "true" }, { "description": "How frequently to invoke the reduce phase (seconds)", "key": "reduce_freq", "value": "0" }, { "description": "Whether to run the search in a separate process", "key": "spawn_process", "value": "true" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] }, "description": "Creates a new search job. The search job runs asynchronously. Use the returned search ID (sid) to check job status and retrieve results. Searches use the Splunk Search Processing Language (SPL)." }, "response": [ { "id": "6147945c-b2ac-4663-b834-9f9417ee2ae8", "name": "Search job created successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Earliest time for the search using relative or absolute time format", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "The search mode", "key": "search_mode", "value": "normal" }, { "description": "Execution mode. Normal runs asynchronously, oneshot runs synchronously, blocking waits for completion.", "key": "exec_mode", "value": "normal" }, { "description": "Maximum number of results to return", "key": "max_count", "value": "10000" }, { "description": "Maximum time in seconds before the search is finalized", "key": "max_time", "value": "0" }, { "description": "Number of seconds to keep the search after processing has stopped", "key": "timeout", "value": "86400" }, { "description": "Comma-separated list of required fields to include in results", "key": "rf", "value": "" }, { "description": "Application namespace for the search", "key": "namespace", "value": "" }, { "description": "Optional custom search ID. If not specified, Splunk generates one automatically.", "key": "id", "value": "" }, { "description": "Number of status buckets to generate for the search timeline. Set to a value greater than 0 to enable timeline.", "key": "status_buckets", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically cancelled. 0 means never auto-cancel.", "key": "auto_cancel", "value": "0" }, { "description": "Auto-finalize the search after this number of events have been processed. 0 disables auto-finalize.", "key": "auto_finalize_ec", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically paused. 0 means never auto-pause.", "key": "auto_pause", "value": "0" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" }, { "description": "Whether to reload macro definitions before the search", "key": "reload_macros", "value": "true" }, { "description": "How frequently to invoke the reduce phase (seconds)", "key": "reduce_freq", "value": "0" }, { "description": "Whether to run the search in a separate process", "key": "spawn_process", "value": "true" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"sid\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-6147945c-b2ac-4663-b834-9f9417ee2ae8" }, { "id": "65fa073b-b5ae-40b1-bde2-bdb08da7cc40", "name": "The request is malformed or contains invalid parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Earliest time for the search using relative or absolute time format", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "The search mode", "key": "search_mode", "value": "normal" }, { "description": "Execution mode. Normal runs asynchronously, oneshot runs synchronously, blocking waits for completion.", "key": "exec_mode", "value": "normal" }, { "description": "Maximum number of results to return", "key": "max_count", "value": "10000" }, { "description": "Maximum time in seconds before the search is finalized", "key": "max_time", "value": "0" }, { "description": "Number of seconds to keep the search after processing has stopped", "key": "timeout", "value": "86400" }, { "description": "Comma-separated list of required fields to include in results", "key": "rf", "value": "" }, { "description": "Application namespace for the search", "key": "namespace", "value": "" }, { "description": "Optional custom search ID. If not specified, Splunk generates one automatically.", "key": "id", "value": "" }, { "description": "Number of status buckets to generate for the search timeline. Set to a value greater than 0 to enable timeline.", "key": "status_buckets", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically cancelled. 0 means never auto-cancel.", "key": "auto_cancel", "value": "0" }, { "description": "Auto-finalize the search after this number of events have been processed. 0 disables auto-finalize.", "key": "auto_finalize_ec", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically paused. 0 means never auto-pause.", "key": "auto_pause", "value": "0" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" }, { "description": "Whether to reload macro definitions before the search", "key": "reload_macros", "value": "true" }, { "description": "How frequently to invoke the reduce phase (seconds)", "key": "reduce_freq", "value": "0" }, { "description": "Whether to run the search in a separate process", "key": "spawn_process", "value": "true" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-65fa073b-b5ae-40b1-bde2-bdb08da7cc40" }, { "id": "6ab7520c-c383-4277-a18c-5b8c326331fd", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Earliest time for the search using relative or absolute time format", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "The search mode", "key": "search_mode", "value": "normal" }, { "description": "Execution mode. Normal runs asynchronously, oneshot runs synchronously, blocking waits for completion.", "key": "exec_mode", "value": "normal" }, { "description": "Maximum number of results to return", "key": "max_count", "value": "10000" }, { "description": "Maximum time in seconds before the search is finalized", "key": "max_time", "value": "0" }, { "description": "Number of seconds to keep the search after processing has stopped", "key": "timeout", "value": "86400" }, { "description": "Comma-separated list of required fields to include in results", "key": "rf", "value": "" }, { "description": "Application namespace for the search", "key": "namespace", "value": "" }, { "description": "Optional custom search ID. If not specified, Splunk generates one automatically.", "key": "id", "value": "" }, { "description": "Number of status buckets to generate for the search timeline. Set to a value greater than 0 to enable timeline.", "key": "status_buckets", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically cancelled. 0 means never auto-cancel.", "key": "auto_cancel", "value": "0" }, { "description": "Auto-finalize the search after this number of events have been processed. 0 disables auto-finalize.", "key": "auto_finalize_ec", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically paused. 0 means never auto-pause.", "key": "auto_pause", "value": "0" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" }, { "description": "Whether to reload macro definitions before the search", "key": "reload_macros", "value": "true" }, { "description": "How frequently to invoke the reduce phase (seconds)", "key": "reduce_freq", "value": "0" }, { "description": "Whether to run the search in a separate process", "key": "spawn_process", "value": "true" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-6ab7520c-c383-4277-a18c-5b8c326331fd" }, { "id": "7d9152ef-3723-4fd5-b990-340c13bc035a", "name": "The authenticated user does not have permission to perform this operation", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The SPL search query to execute", "key": "search", "value": "" }, { "description": "Earliest time for the search using relative or absolute time format", "key": "earliest_time", "value": "" }, { "description": "Latest time for the search", "key": "latest_time", "value": "" }, { "description": "The search mode", "key": "search_mode", "value": "normal" }, { "description": "Execution mode. Normal runs asynchronously, oneshot runs synchronously, blocking waits for completion.", "key": "exec_mode", "value": "normal" }, { "description": "Maximum number of results to return", "key": "max_count", "value": "10000" }, { "description": "Maximum time in seconds before the search is finalized", "key": "max_time", "value": "0" }, { "description": "Number of seconds to keep the search after processing has stopped", "key": "timeout", "value": "86400" }, { "description": "Comma-separated list of required fields to include in results", "key": "rf", "value": "" }, { "description": "Application namespace for the search", "key": "namespace", "value": "" }, { "description": "Optional custom search ID. If not specified, Splunk generates one automatically.", "key": "id", "value": "" }, { "description": "Number of status buckets to generate for the search timeline. Set to a value greater than 0 to enable timeline.", "key": "status_buckets", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically cancelled. 0 means never auto-cancel.", "key": "auto_cancel", "value": "0" }, { "description": "Auto-finalize the search after this number of events have been processed. 0 disables auto-finalize.", "key": "auto_finalize_ec", "value": "0" }, { "description": "Seconds of inactivity after which the search is automatically paused. 0 means never auto-pause.", "key": "auto_pause", "value": "0" }, { "description": "Whether to enable lookups during the search", "key": "enable_lookups", "value": "true" }, { "description": "Whether to reload macro definitions before the search", "key": "reload_macros", "value": "true" }, { "description": "How frequently to invoke the reduce phase (seconds)", "key": "reduce_freq", "value": "0" }, { "description": "Whether to run the search in a separate process", "key": "spawn_process", "value": "true" } ] }, "url": { "raw": "{{baseUrl}}/services/search/jobs?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "search", "jobs" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-7d9152ef-3723-4fd5-b990-340c13bc035a" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-0b7adfdb-abc7-4c67-9a29-c2bc481e44cd" } ], "id": "de98022b-4b5f-4769-ba84-d30c734fe75c", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-de98022b-4b5f-4769-ba84-d30c734fe75c" } ], "id": "d7c2b522-73a9-475d-802c-fbac659a97bc", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d7c2b522-73a9-475d-802c-fbac659a97bc" }, { "name": "data", "item": [ { "name": "indexes", "item": [ { "name": "{name}", "item": [ { "name": "Get Index Details", "id": "d0af263d-e975-4f96-9101-3c1d54a3f875", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "id": "1f97202f-9fb1-422a-905e-8fb4617c82ad", "key": "name", "value": "", "description": "(Required) The name of the index" } ] }, "description": "Returns detailed configuration and status information for a specific index including storage paths, retention settings, and current size." }, "response": [ { "id": "f0950832-ac43-4f60-8228-0af8205b5355", "name": "Index details returned successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"name\": \"\",\n \"content\": {\n \"datatype\": \"event\",\n \"totalEventCount\": \"\",\n \"currentDBSizeMB\": \"\",\n \"maxDataSize\": \"auto\",\n \"maxTotalDataSizeMB\": 500000,\n \"maxHotBuckets\": 3,\n \"maxWarmDBCount\": 300,\n \"frozenTimePeriodInSecs\": 188697600,\n \"homePath\": \"\",\n \"coldPath\": \"\",\n \"thawedPath\": \"\",\n \"disabled\": \"\",\n \"isInternal\": \"\",\n \"minTime\": \"\",\n \"maxTime\": \"\",\n \"repFactor\": \"\",\n \"enableOnlineBucketRepair\": \"\",\n \"quarantinePastSecs\": \"\",\n \"quarantineFutureSecs\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-f0950832-ac43-4f60-8228-0af8205b5355" }, { "id": "5223c0cc-2d53-4520-b9d9-9797d22bc440", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-5223c0cc-2d53-4520-b9d9-9797d22bc440" }, { "id": "cfc8e120-04f6-4074-ad9f-fadd8bfa9531", "name": "The requested resource was not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-cfc8e120-04f6-4074-ad9f-fadd8bfa9531" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d0af263d-e975-4f96-9101-3c1d54a3f875" }, { "name": "Update Index Configuration", "id": "06b4f134-1617-49ff-a57d-5e1fbb19e584", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "" }, { "description": "Whether to disable the index", "key": "disabled", "value": "" }, { "description": "Path to archive frozen buckets to. If not set, frozen data is deleted.", "key": "coldToFrozenDir", "value": "" }, { "description": "Script to run when freezing buckets", "key": "coldToFrozenScript", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "id": "ff7cf1ee-4402-4afc-ac74-82a5edcd442b", "key": "name", "value": "", "description": "(Required) The name of the index" } ] }, "description": "Updates the configuration of an existing index. Not all index properties can be modified after creation." }, "response": [ { "id": "5386aca1-ebff-4466-b87b-c1f0b00c930e", "name": "Index updated successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "" }, { "description": "Whether to disable the index", "key": "disabled", "value": "" }, { "description": "Path to archive frozen buckets to. If not set, frozen data is deleted.", "key": "coldToFrozenDir", "value": "" }, { "description": "Script to run when freezing buckets", "key": "coldToFrozenScript", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"name\": \"\",\n \"content\": {\n \"datatype\": \"event\",\n \"totalEventCount\": \"\",\n \"currentDBSizeMB\": \"\",\n \"maxDataSize\": \"auto\",\n \"maxTotalDataSizeMB\": 500000,\n \"maxHotBuckets\": 3,\n \"maxWarmDBCount\": 300,\n \"frozenTimePeriodInSecs\": 188697600,\n \"homePath\": \"\",\n \"coldPath\": \"\",\n \"thawedPath\": \"\",\n \"disabled\": \"\",\n \"isInternal\": \"\",\n \"minTime\": \"\",\n \"maxTime\": \"\",\n \"repFactor\": \"\",\n \"enableOnlineBucketRepair\": \"\",\n \"quarantinePastSecs\": \"\",\n \"quarantineFutureSecs\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-5386aca1-ebff-4466-b87b-c1f0b00c930e" }, { "id": "7e2005a3-93b7-4593-bb5c-e8ceed8c81a1", "name": "The request is malformed or contains invalid parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "" }, { "description": "Whether to disable the index", "key": "disabled", "value": "" }, { "description": "Path to archive frozen buckets to. If not set, frozen data is deleted.", "key": "coldToFrozenDir", "value": "" }, { "description": "Script to run when freezing buckets", "key": "coldToFrozenScript", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-7e2005a3-93b7-4593-bb5c-e8ceed8c81a1" }, { "id": "a1d035e9-d45f-49eb-8d47-a9727392937e", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "" }, { "description": "Whether to disable the index", "key": "disabled", "value": "" }, { "description": "Path to archive frozen buckets to. If not set, frozen data is deleted.", "key": "coldToFrozenDir", "value": "" }, { "description": "Script to run when freezing buckets", "key": "coldToFrozenScript", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a1d035e9-d45f-49eb-8d47-a9727392937e" }, { "id": "25bb1b0f-8a79-4e16-8e52-d9c6d67063e0", "name": "The requested resource was not found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "" }, { "description": "Whether to disable the index", "key": "disabled", "value": "" }, { "description": "Path to archive frozen buckets to. If not set, frozen data is deleted.", "key": "coldToFrozenDir", "value": "" }, { "description": "Script to run when freezing buckets", "key": "coldToFrozenScript", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-25bb1b0f-8a79-4e16-8e52-d9c6d67063e0" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-06b4f134-1617-49ff-a57d-5e1fbb19e584" }, { "name": "Delete an Index", "id": "c19ec9bc-5c62-4acd-b489-d16e52682917", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "variable": [ { "id": "3d2b81ee-f683-447d-9855-03241276e02c", "key": "name", "value": "", "description": "(Required) The name of the index" } ] }, "description": "Marks an index for deletion. The index data is removed according to the configured retention policy. Requires the admin role." }, "response": [ { "id": "e614498b-5e9b-4578-8755-67976b40be2b", "name": "Index marked for deletion", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "variable": [ { "key": "name" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-e614498b-5e9b-4578-8755-67976b40be2b" }, { "id": "d78668f2-ce27-47ae-a4d5-e23f20e34de6", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "variable": [ { "key": "name" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d78668f2-ce27-47ae-a4d5-e23f20e34de6" }, { "id": "c06ef1b4-7fdd-420b-a22c-6e6555254d11", "name": "The authenticated user does not have permission to perform this operation", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "variable": [ { "key": "name" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-c06ef1b4-7fdd-420b-a22c-6e6555254d11" }, { "id": "c49d8a94-fbbe-464d-900d-64e3ce06aecc", "name": "The requested resource was not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes", ":name" ], "variable": [ { "key": "name" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-c49d8a94-fbbe-464d-900d-64e3ce06aecc" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-c19ec9bc-5c62-4acd-b489-d16e52682917" } ], "id": "a82f0369-54c0-4dd5-b904-d018a923be62", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a82f0369-54c0-4dd5-b904-d018a923be62" }, { "name": "List Indexes", "id": "0f3e5766-ffb1-4257-8258-65913de59734", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml&count=30&offset=0&search=&sort_key=&sort_dir=desc&datatype=all", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter indexes by name or properties", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" }, { "description": "Filter by data type", "key": "datatype", "value": "all" } ] }, "description": "Returns a list of all indexes accessible to the authenticated user. Includes index configuration, storage paths, and data retention settings." }, "response": [ { "id": "5c83c1cf-30f8-4d13-bb07-a8ddf1999333", "name": "Index list returned successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml&count=30&offset=0&search=&sort_key=&sort_dir=desc&datatype=all", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter indexes by name or properties", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" }, { "description": "Filter by data type", "key": "datatype", "value": "all" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"origin\": \"\",\n \"updated\": \"\",\n \"entry\": [\n {\n \"name\": \"\",\n \"content\": {\n \"datatype\": \"metric\",\n \"totalEventCount\": \"\",\n \"currentDBSizeMB\": \"\",\n \"maxDataSize\": \"auto\",\n \"maxTotalDataSizeMB\": 500000,\n \"maxHotBuckets\": 3,\n \"maxWarmDBCount\": 300,\n \"frozenTimePeriodInSecs\": 188697600,\n \"homePath\": \"\",\n \"coldPath\": \"\",\n \"thawedPath\": \"\",\n \"disabled\": \"\",\n \"isInternal\": \"\",\n \"minTime\": \"\",\n \"maxTime\": \"\",\n \"repFactor\": \"\",\n \"enableOnlineBucketRepair\": \"\",\n \"quarantinePastSecs\": \"\",\n \"quarantineFutureSecs\": \"\"\n }\n },\n {\n \"name\": \"\",\n \"content\": {\n \"datatype\": \"event\",\n \"totalEventCount\": \"\",\n \"currentDBSizeMB\": \"\",\n \"maxDataSize\": \"auto\",\n \"maxTotalDataSizeMB\": 500000,\n \"maxHotBuckets\": 3,\n \"maxWarmDBCount\": 300,\n \"frozenTimePeriodInSecs\": 188697600,\n \"homePath\": \"\",\n \"coldPath\": \"\",\n \"thawedPath\": \"\",\n \"disabled\": \"\",\n \"isInternal\": \"\",\n \"minTime\": \"\",\n \"maxTime\": \"\",\n \"repFactor\": \"\",\n \"enableOnlineBucketRepair\": \"\",\n \"quarantinePastSecs\": \"\",\n \"quarantineFutureSecs\": \"\"\n }\n }\n ],\n \"paging\": {\n \"total\": \"\",\n \"perPage\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-5c83c1cf-30f8-4d13-bb07-a8ddf1999333" }, { "id": "2187892c-2f20-4e49-a7e7-9b07fda41d46", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml&count=30&offset=0&search=&sort_key=&sort_dir=desc&datatype=all", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter indexes by name or properties", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" }, { "description": "Filter by data type", "key": "datatype", "value": "all" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-2187892c-2f20-4e49-a7e7-9b07fda41d46" }, { "id": "71c38598-7afa-4175-b88b-7b2b304b8bfb", "name": "The authenticated user does not have permission to perform this operation", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml&count=30&offset=0&search=&sort_key=&sort_dir=desc&datatype=all", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter indexes by name or properties", "key": "search", "value": "" }, { "description": "Field to sort by", "key": "sort_key", "value": "" }, { "description": "Sort direction", "key": "sort_dir", "value": "desc" }, { "description": "Filter by data type", "key": "datatype", "value": "all" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-71c38598-7afa-4175-b88b-7b2b304b8bfb" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-0f3e5766-ffb1-4257-8258-65913de59734" }, { "name": "Create a New Index", "id": "38d77ab9-11fb-4125-a0de-59b7dce843e3", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The name for the new index", "key": "name", "value": "" }, { "description": "Type of data the index will hold", "key": "datatype", "value": "event" }, { "description": "Absolute path for hot and warm bucket storage", "key": "homePath", "value": "" }, { "description": "Absolute path for cold bucket storage", "key": "coldPath", "value": "" }, { "description": "Absolute path for thawed bucket storage", "key": "thawedPath", "value": "" }, { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "500000" }, { "description": "Maximum size of a hot bucket", "key": "maxDataSize", "value": "auto" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "188697600" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "3" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "300" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] }, "description": "Creates a new index with the specified configuration. The index name must be unique and conform to Splunk naming conventions." }, "response": [ { "id": "05296c8d-fd94-41f4-91f8-6fe1d1cda49f", "name": "Index created successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The name for the new index", "key": "name", "value": "" }, { "description": "Type of data the index will hold", "key": "datatype", "value": "event" }, { "description": "Absolute path for hot and warm bucket storage", "key": "homePath", "value": "" }, { "description": "Absolute path for cold bucket storage", "key": "coldPath", "value": "" }, { "description": "Absolute path for thawed bucket storage", "key": "thawedPath", "value": "" }, { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "500000" }, { "description": "Maximum size of a hot bucket", "key": "maxDataSize", "value": "auto" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "188697600" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "3" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "300" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"name\": \"\",\n \"content\": {\n \"datatype\": \"event\",\n \"totalEventCount\": \"\",\n \"currentDBSizeMB\": \"\",\n \"maxDataSize\": \"auto\",\n \"maxTotalDataSizeMB\": 500000,\n \"maxHotBuckets\": 3,\n \"maxWarmDBCount\": 300,\n \"frozenTimePeriodInSecs\": 188697600,\n \"homePath\": \"\",\n \"coldPath\": \"\",\n \"thawedPath\": \"\",\n \"disabled\": \"\",\n \"isInternal\": \"\",\n \"minTime\": \"\",\n \"maxTime\": \"\",\n \"repFactor\": \"\",\n \"enableOnlineBucketRepair\": \"\",\n \"quarantinePastSecs\": \"\",\n \"quarantineFutureSecs\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-05296c8d-fd94-41f4-91f8-6fe1d1cda49f" }, { "id": "0bc96687-c652-4200-aa22-d7be4c2d162f", "name": "The request is malformed or contains invalid parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The name for the new index", "key": "name", "value": "" }, { "description": "Type of data the index will hold", "key": "datatype", "value": "event" }, { "description": "Absolute path for hot and warm bucket storage", "key": "homePath", "value": "" }, { "description": "Absolute path for cold bucket storage", "key": "coldPath", "value": "" }, { "description": "Absolute path for thawed bucket storage", "key": "thawedPath", "value": "" }, { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "500000" }, { "description": "Maximum size of a hot bucket", "key": "maxDataSize", "value": "auto" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "188697600" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "3" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "300" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-0bc96687-c652-4200-aa22-d7be4c2d162f" }, { "id": "bcf67d81-d93b-479b-b57d-3a684ae78fb3", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The name for the new index", "key": "name", "value": "" }, { "description": "Type of data the index will hold", "key": "datatype", "value": "event" }, { "description": "Absolute path for hot and warm bucket storage", "key": "homePath", "value": "" }, { "description": "Absolute path for cold bucket storage", "key": "coldPath", "value": "" }, { "description": "Absolute path for thawed bucket storage", "key": "thawedPath", "value": "" }, { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "500000" }, { "description": "Maximum size of a hot bucket", "key": "maxDataSize", "value": "auto" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "188697600" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "3" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "300" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-bcf67d81-d93b-479b-b57d-3a684ae78fb3" }, { "id": "9d47ffa9-88a8-4d49-a0ae-59015a0df121", "name": "The authenticated user does not have permission to perform this operation", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The name for the new index", "key": "name", "value": "" }, { "description": "Type of data the index will hold", "key": "datatype", "value": "event" }, { "description": "Absolute path for hot and warm bucket storage", "key": "homePath", "value": "" }, { "description": "Absolute path for cold bucket storage", "key": "coldPath", "value": "" }, { "description": "Absolute path for thawed bucket storage", "key": "thawedPath", "value": "" }, { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "500000" }, { "description": "Maximum size of a hot bucket", "key": "maxDataSize", "value": "auto" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "188697600" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "3" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "300" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-9d47ffa9-88a8-4d49-a0ae-59015a0df121" }, { "id": "a947122e-5184-4bbd-944f-6f0959909835", "name": "An index with the specified name already exists", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The name for the new index", "key": "name", "value": "" }, { "description": "Type of data the index will hold", "key": "datatype", "value": "event" }, { "description": "Absolute path for hot and warm bucket storage", "key": "homePath", "value": "" }, { "description": "Absolute path for cold bucket storage", "key": "coldPath", "value": "" }, { "description": "Absolute path for thawed bucket storage", "key": "thawedPath", "value": "" }, { "description": "Maximum total size of the index in MB", "key": "maxTotalDataSizeMB", "value": "500000" }, { "description": "Maximum size of a hot bucket", "key": "maxDataSize", "value": "auto" }, { "description": "Seconds until data is frozen", "key": "frozenTimePeriodInSecs", "value": "188697600" }, { "description": "Maximum number of hot buckets", "key": "maxHotBuckets", "value": "3" }, { "description": "Maximum number of warm buckets", "key": "maxWarmDBCount", "value": "300" } ] }, "url": { "raw": "{{baseUrl}}/services/data/indexes?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "indexes" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Conflict", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a947122e-5184-4bbd-944f-6f0959909835" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-38d77ab9-11fb-4125-a0de-59b7dce843e3" } ], "id": "66fcbbc2-3520-41c5-88d5-f595881a0b39", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-66fcbbc2-3520-41c5-88d5-f595881a0b39" }, { "name": "inputs", "item": [ { "name": "monitor", "item": [ { "name": "{name}", "item": [ { "name": "Get Monitor Input Details", "id": "6ca49a3b-9e82-49fb-90f3-6f165e74b657", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "id": "295f3c89-2bff-47ce-9ece-20e8d086a8e3", "key": "name", "value": "", "description": "(Required) The name (path) of the monitor input" } ] }, "description": "Returns configuration details for a specific file or directory monitoring input." }, "response": [ { "id": "77ed5b7d-7d1d-42c2-986c-37f54efe229b", "name": "Monitor input details returned successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"name\": \"\",\n \"content\": {\n \"index\": \"default\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"followTail\": \"\",\n \"recursive\": \"\",\n \"whitelist\": \"\",\n \"blacklist\": \"\",\n \"crcSalt\": \"\",\n \"ignoreOlderThan\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-77ed5b7d-7d1d-42c2-986c-37f54efe229b" }, { "id": "242d6a51-6518-4b65-bcbb-42dd3cc52beb", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-242d6a51-6518-4b65-bcbb-42dd3cc52beb" }, { "id": "37a897ef-e8c8-4232-b248-d27abb7e52fa", "name": "The requested resource was not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-37a897ef-e8c8-4232-b248-d27abb7e52fa" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-6ca49a3b-9e82-49fb-90f3-6f165e74b657" }, { "name": "Update a Monitor Input", "id": "43617d7f-bea0-431c-a04d-30da4175b522", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Destination index", "key": "index", "value": "" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to disable the input", "key": "disabled", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "id": "e918279c-0954-4a41-9508-76d18436184c", "key": "name", "value": "", "description": "(Required) The name (path) of the monitor input" } ] }, "description": "Updates the configuration of an existing monitor input." }, "response": [ { "id": "05e6d964-e64b-4916-9c3a-91978bf56f8a", "name": "Monitor input updated successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Destination index", "key": "index", "value": "" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to disable the input", "key": "disabled", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"name\": \"\",\n \"content\": {\n \"index\": \"default\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"followTail\": \"\",\n \"recursive\": \"\",\n \"whitelist\": \"\",\n \"blacklist\": \"\",\n \"crcSalt\": \"\",\n \"ignoreOlderThan\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-05e6d964-e64b-4916-9c3a-91978bf56f8a" }, { "id": "7915fa8e-e2fb-4c19-bc6c-6f086c1178bc", "name": "The request is malformed or contains invalid parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Destination index", "key": "index", "value": "" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to disable the input", "key": "disabled", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-7915fa8e-e2fb-4c19-bc6c-6f086c1178bc" }, { "id": "2230aa53-3bc0-4e3f-8072-937c72704b8e", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Destination index", "key": "index", "value": "" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to disable the input", "key": "disabled", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-2230aa53-3bc0-4e3f-8072-937c72704b8e" }, { "id": "e43fb092-d519-47d0-bcf1-2998dbc8a302", "name": "The requested resource was not found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "Destination index", "key": "index", "value": "" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to disable the input", "key": "disabled", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ], "variable": [ { "key": "name" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-e43fb092-d519-47d0-bcf1-2998dbc8a302" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-43617d7f-bea0-431c-a04d-30da4175b522" }, { "name": "Delete a Monitor Input", "id": "c4af2295-1cc5-4730-add1-b70f3878f44e", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "variable": [ { "id": "2adebfcc-7c10-49bd-abcc-362682ff12dd", "key": "name", "value": "", "description": "(Required) The name (path) of the monitor input" } ] }, "description": "Deletes the specified monitor input. Splunk stops monitoring the associated file or directory." }, "response": [ { "id": "3e63bd3b-4c39-443c-92be-4d65d1db2299", "name": "Monitor input deleted successfully", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "variable": [ { "key": "name" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-3e63bd3b-4c39-443c-92be-4d65d1db2299" }, { "id": "77057b68-0717-4cd1-82f5-c8c7dc428830", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "variable": [ { "key": "name" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-77057b68-0717-4cd1-82f5-c8c7dc428830" }, { "id": "423a5dad-aa9b-4747-b477-513e621ebf12", "name": "The requested resource was not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor/:name", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor", ":name" ], "variable": [ { "key": "name" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-423a5dad-aa9b-4747-b477-513e621ebf12" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-c4af2295-1cc5-4730-add1-b70f3878f44e" } ], "id": "2d2cde28-eb84-41c9-a4d9-1f982f2e51de", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-2d2cde28-eb84-41c9-a4d9-1f982f2e51de" }, { "name": "List File and Directory Monitor Inputs", "id": "5eafdfb7-91dd-4cbb-9759-21f6f708de5f", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml&count=30&offset=0&search=", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter inputs by search string", "key": "search", "value": "" } ] }, "description": "Returns a list of file and directory monitoring inputs. Monitor inputs continuously watch files and directories for new data." }, "response": [ { "id": "e7946e17-674f-462b-ae9e-25997822f79c", "name": "Monitor inputs listed successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml&count=30&offset=0&search=", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter inputs by search string", "key": "search", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"origin\": \"\",\n \"updated\": \"\",\n \"entry\": [\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"default\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"followTail\": \"\",\n \"recursive\": \"\",\n \"whitelist\": \"\",\n \"blacklist\": \"\",\n \"crcSalt\": \"\",\n \"ignoreOlderThan\": \"\"\n }\n },\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"default\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"followTail\": \"\",\n \"recursive\": \"\",\n \"whitelist\": \"\",\n \"blacklist\": \"\",\n \"crcSalt\": \"\",\n \"ignoreOlderThan\": \"\"\n }\n }\n ],\n \"paging\": {\n \"total\": \"\",\n \"perPage\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-e7946e17-674f-462b-ae9e-25997822f79c" }, { "id": "760a0ba8-9ee4-433e-82a9-f10f656540d8", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml&count=30&offset=0&search=", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" }, { "description": "Filter inputs by search string", "key": "search", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-760a0ba8-9ee4-433e-82a9-f10f656540d8" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-5eafdfb7-91dd-4cbb-9759-21f6f708de5f" }, { "name": "Create a File or Directory Monitor Input", "id": "c5dcc14a-68f7-4ccd-8a4c-bbf0886d3a7b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The file or directory path to monitor", "key": "name", "value": "" }, { "description": "Destination index", "key": "index", "value": "default" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to create the input in disabled state", "key": "disabled", "value": "false" }, { "description": "Start monitoring from end of file", "key": "followTail", "value": "false" }, { "description": "Recursively monitor subdirectories", "key": "recursive", "value": "true" }, { "description": "Regex pattern for files to include", "key": "whitelist", "value": "" }, { "description": "Regex pattern for files to exclude", "key": "blacklist", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] }, "description": "Creates a new file or directory monitoring input. The specified path will be monitored for new data and ingested into the specified index." }, "response": [ { "id": "0b22faa0-8d19-46fc-9113-066ccb8e98ca", "name": "Monitor input created successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The file or directory path to monitor", "key": "name", "value": "" }, { "description": "Destination index", "key": "index", "value": "default" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to create the input in disabled state", "key": "disabled", "value": "false" }, { "description": "Start monitoring from end of file", "key": "followTail", "value": "false" }, { "description": "Recursively monitor subdirectories", "key": "recursive", "value": "true" }, { "description": "Regex pattern for files to include", "key": "whitelist", "value": "" }, { "description": "Regex pattern for files to exclude", "key": "blacklist", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"name\": \"\",\n \"content\": {\n \"index\": \"default\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"followTail\": \"\",\n \"recursive\": \"\",\n \"whitelist\": \"\",\n \"blacklist\": \"\",\n \"crcSalt\": \"\",\n \"ignoreOlderThan\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-0b22faa0-8d19-46fc-9113-066ccb8e98ca" }, { "id": "5d4676a1-8438-4c70-9d33-f675207a974c", "name": "The request is malformed or contains invalid parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The file or directory path to monitor", "key": "name", "value": "" }, { "description": "Destination index", "key": "index", "value": "default" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to create the input in disabled state", "key": "disabled", "value": "false" }, { "description": "Start monitoring from end of file", "key": "followTail", "value": "false" }, { "description": "Recursively monitor subdirectories", "key": "recursive", "value": "true" }, { "description": "Regex pattern for files to include", "key": "whitelist", "value": "" }, { "description": "Regex pattern for files to exclude", "key": "blacklist", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-5d4676a1-8438-4c70-9d33-f675207a974c" }, { "id": "f20f85b0-df90-439e-9cb7-2bbc4c082ed9", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The file or directory path to monitor", "key": "name", "value": "" }, { "description": "Destination index", "key": "index", "value": "default" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to create the input in disabled state", "key": "disabled", "value": "false" }, { "description": "Start monitoring from end of file", "key": "followTail", "value": "false" }, { "description": "Recursively monitor subdirectories", "key": "recursive", "value": "true" }, { "description": "Regex pattern for files to include", "key": "whitelist", "value": "" }, { "description": "Regex pattern for files to exclude", "key": "blacklist", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-f20f85b0-df90-439e-9cb7-2bbc4c082ed9" }, { "id": "0b77a9d0-2cf0-4a3d-bc9e-760df89a9ca0", "name": "A monitor input for this path already exists", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The file or directory path to monitor", "key": "name", "value": "" }, { "description": "Destination index", "key": "index", "value": "default" }, { "description": "Source type to assign", "key": "sourcetype", "value": "" }, { "description": "Source value to assign", "key": "source", "value": "" }, { "description": "Host value to assign", "key": "host", "value": "" }, { "description": "Whether to create the input in disabled state", "key": "disabled", "value": "false" }, { "description": "Start monitoring from end of file", "key": "followTail", "value": "false" }, { "description": "Recursively monitor subdirectories", "key": "recursive", "value": "true" }, { "description": "Regex pattern for files to include", "key": "whitelist", "value": "" }, { "description": "Regex pattern for files to exclude", "key": "blacklist", "value": "" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/monitor?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "monitor" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Conflict", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-0b77a9d0-2cf0-4a3d-bc9e-760df89a9ca0" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-c5dcc14a-68f7-4ccd-8a4c-bbf0886d3a7b" } ], "id": "ca14821d-b1da-4f37-a9ee-2c9c2afced8a", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-ca14821d-b1da-4f37-a9ee-2c9c2afced8a" }, { "name": "tcp", "item": [ { "name": "cooked", "item": [ { "name": "List Cooked Tcp Inputs", "id": "71939418-f977-4355-a8d3-58d0a101a8fb", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/tcp/cooked?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "tcp", "cooked" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] }, "description": "Returns a list of TCP cooked data inputs. Cooked TCP inputs receive data from Splunk forwarders." }, "response": [ { "id": "bf737bcd-883b-42d1-b1d0-8a8452b1685b", "name": "TCP cooked inputs listed successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/tcp/cooked?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "tcp", "cooked" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"origin\": \"\",\n \"updated\": \"\",\n \"entry\": [\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"restrictToHost\": \"\",\n \"connection_host\": \"ip\",\n \"ssl\": \"\"\n }\n },\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"restrictToHost\": \"\",\n \"connection_host\": \"none\",\n \"ssl\": \"\"\n }\n }\n ],\n \"paging\": {\n \"total\": \"\",\n \"perPage\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-bf737bcd-883b-42d1-b1d0-8a8452b1685b" }, { "id": "843ff193-efcd-4d5c-864d-964a7939185f", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/tcp/cooked?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "tcp", "cooked" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-843ff193-efcd-4d5c-864d-964a7939185f" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-71939418-f977-4355-a8d3-58d0a101a8fb" } ], "id": "d10ff159-23ae-49bc-b2a8-e1a2aa98c790", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d10ff159-23ae-49bc-b2a8-e1a2aa98c790" }, { "name": "raw", "item": [ { "name": "List Raw Tcp Inputs", "id": "dc27cc6b-36eb-4588-9979-4f3c814e8ada", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/tcp/raw?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "tcp", "raw" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] }, "description": "Returns a list of raw TCP data inputs. Raw TCP inputs receive data directly over a TCP port without Splunk protocol framing." }, "response": [ { "id": "01972d16-55b4-490e-aa64-a70d56dffcb9", "name": "TCP raw inputs listed successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/tcp/raw?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "tcp", "raw" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"origin\": \"\",\n \"updated\": \"\",\n \"entry\": [\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"restrictToHost\": \"\",\n \"connection_host\": \"ip\",\n \"ssl\": \"\"\n }\n },\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"restrictToHost\": \"\",\n \"connection_host\": \"none\",\n \"ssl\": \"\"\n }\n }\n ],\n \"paging\": {\n \"total\": \"\",\n \"perPage\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-01972d16-55b4-490e-aa64-a70d56dffcb9" }, { "id": "3dc371c0-8c6a-44d2-8757-c24e5bcd18e5", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/tcp/raw?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "tcp", "raw" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-3dc371c0-8c6a-44d2-8757-c24e5bcd18e5" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-dc27cc6b-36eb-4588-9979-4f3c814e8ada" } ], "id": "e11abfb1-29ac-4460-b7c4-b80d46b39943", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-e11abfb1-29ac-4460-b7c4-b80d46b39943" } ], "id": "a9e657e7-5030-44ac-aa43-7d4631eefc04", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a9e657e7-5030-44ac-aa43-7d4631eefc04" }, { "name": "udp", "item": [ { "name": "List Udp Inputs", "id": "8ff49500-0ba8-4ac6-b62e-66f776ed95d2", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/udp?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "udp" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] }, "description": "Returns a list of UDP data inputs. UDP inputs receive data over a UDP port." }, "response": [ { "id": "600d1740-7272-4227-b812-ead632b209aa", "name": "UDP inputs listed successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/udp?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "udp" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"origin\": \"\",\n \"updated\": \"\",\n \"entry\": [\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"connection_host\": \"ip\",\n \"no_appending_timestamp\": \"\",\n \"no_priority_stripping\": \"\"\n }\n },\n {\n \"name\": \"\",\n \"content\": {\n \"index\": \"\",\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"connection_host\": \"ip\",\n \"no_appending_timestamp\": \"\",\n \"no_priority_stripping\": \"\"\n }\n }\n ],\n \"paging\": {\n \"total\": \"\",\n \"perPage\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-600d1740-7272-4227-b812-ead632b209aa" }, { "id": "d87fd03d-7452-424e-bded-e055d4fc5cc3", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/udp?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "udp" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d87fd03d-7452-424e-bded-e055d4fc5cc3" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-8ff49500-0ba8-4ac6-b62e-66f776ed95d2" } ], "id": "7b37450f-7c52-4a7d-8402-76ec666661bf", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-7b37450f-7c52-4a7d-8402-76ec666661bf" }, { "name": "http", "item": [ { "name": "List Http Event Collector Tokens", "id": "91caf036-cbd1-4882-9ef1-015794826ac7", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] }, "description": "Returns a list of HTTP Event Collector (HEC) tokens configured on the Splunk instance. Each token defines an input channel for receiving data over HTTP/HTTPS." }, "response": [ { "id": "9b8f8865-01a5-48e0-a4c8-36e9710d6e93", "name": "HEC tokens listed successfully", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"origin\": \"\",\n \"updated\": \"\",\n \"entry\": [\n {\n \"name\": \"\",\n \"content\": {\n \"token\": \"\",\n \"index\": \"\",\n \"indexes\": [\n \"\",\n \"\"\n ],\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"useACK\": \"\"\n }\n },\n {\n \"name\": \"\",\n \"content\": {\n \"token\": \"\",\n \"index\": \"\",\n \"indexes\": [\n \"\",\n \"\"\n ],\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"useACK\": \"\"\n }\n }\n ],\n \"paging\": {\n \"total\": \"\",\n \"perPage\": \"\",\n \"offset\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-9b8f8865-01a5-48e0-a4c8-36e9710d6e93" }, { "id": "46810aa7-bb75-4397-93b1-0a7b2c805b3e", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml&count=30&offset=0", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" }, { "description": "Maximum number of items to return. A value of 0 returns all items.", "key": "count", "value": "30" }, { "description": "Index of the first item to return. Used with count for pagination.", "key": "offset", "value": "0" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-46810aa7-bb75-4397-93b1-0a7b2c805b3e" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-91caf036-cbd1-4882-9ef1-015794826ac7" }, { "name": "Create an Http Event Collector Token", "id": "28c96057-82ed-47e6-bc84-fdfc1f12779b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) Name for the new HEC token", "key": "name", "value": "" }, { "description": "Default destination index", "key": "index", "value": "main" }, { "description": "Comma-separated list of allowed indexes", "key": "indexes", "value": "" }, { "description": "Default sourcetype", "key": "sourcetype", "value": "" }, { "description": "Default source value", "key": "source", "value": "" }, { "description": "Default host value", "key": "host", "value": "" }, { "description": "Whether to create the token in disabled state", "key": "disabled", "value": "false" }, { "description": "Whether to enable indexer acknowledgment", "key": "useACK", "value": "false" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] }, "description": "Creates a new HTTP Event Collector (HEC) token for data ingestion over HTTP/HTTPS." }, "response": [ { "id": "860921fd-4f63-499b-b608-4558862e6887", "name": "HEC token created successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) Name for the new HEC token", "key": "name", "value": "" }, { "description": "Default destination index", "key": "index", "value": "main" }, { "description": "Comma-separated list of allowed indexes", "key": "indexes", "value": "" }, { "description": "Default sourcetype", "key": "sourcetype", "value": "" }, { "description": "Default source value", "key": "source", "value": "" }, { "description": "Default host value", "key": "host", "value": "" }, { "description": "Whether to create the token in disabled state", "key": "disabled", "value": "false" }, { "description": "Whether to enable indexer acknowledgment", "key": "useACK", "value": "false" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"name\": \"\",\n \"content\": {\n \"token\": \"\",\n \"index\": \"\",\n \"indexes\": [\n \"\",\n \"\"\n ],\n \"sourcetype\": \"\",\n \"source\": \"\",\n \"host\": \"\",\n \"disabled\": \"\",\n \"useACK\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-860921fd-4f63-499b-b608-4558862e6887" }, { "id": "28d57d9a-dffd-43a2-a02f-64f0d07674c7", "name": "The request is malformed or contains invalid parameters", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) Name for the new HEC token", "key": "name", "value": "" }, { "description": "Default destination index", "key": "index", "value": "main" }, { "description": "Comma-separated list of allowed indexes", "key": "indexes", "value": "" }, { "description": "Default sourcetype", "key": "sourcetype", "value": "" }, { "description": "Default source value", "key": "source", "value": "" }, { "description": "Default host value", "key": "host", "value": "" }, { "description": "Whether to create the token in disabled state", "key": "disabled", "value": "false" }, { "description": "Whether to enable indexer acknowledgment", "key": "useACK", "value": "false" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-28d57d9a-dffd-43a2-a02f-64f0d07674c7" }, { "id": "38f8ecc6-71fc-4bb8-9553-17b5c3417c48", "name": "Authentication credentials are missing, invalid, or expired", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) Name for the new HEC token", "key": "name", "value": "" }, { "description": "Default destination index", "key": "index", "value": "main" }, { "description": "Comma-separated list of allowed indexes", "key": "indexes", "value": "" }, { "description": "Default sourcetype", "key": "sourcetype", "value": "" }, { "description": "Default source value", "key": "source", "value": "" }, { "description": "Default host value", "key": "host", "value": "" }, { "description": "Whether to create the token in disabled state", "key": "disabled", "value": "false" }, { "description": "Whether to enable indexer acknowledgment", "key": "useACK", "value": "false" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-38f8ecc6-71fc-4bb8-9553-17b5c3417c48" }, { "id": "8fbc8cdc-050a-49d0-81a4-c5194233d71b", "name": "A token with that name already exists", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: bearer", "key": "Authorization", "value": "Bearer " } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) Name for the new HEC token", "key": "name", "value": "" }, { "description": "Default destination index", "key": "index", "value": "main" }, { "description": "Comma-separated list of allowed indexes", "key": "indexes", "value": "" }, { "description": "Default sourcetype", "key": "sourcetype", "value": "" }, { "description": "Default source value", "key": "source", "value": "" }, { "description": "Default host value", "key": "host", "value": "" }, { "description": "Whether to create the token in disabled state", "key": "disabled", "value": "false" }, { "description": "Whether to enable indexer acknowledgment", "key": "useACK", "value": "false" } ] }, "url": { "raw": "{{baseUrl}}/services/data/inputs/http?output_mode=xml", "host": [ "{{baseUrl}}" ], "path": [ "services", "data", "inputs", "http" ], "query": [ { "description": "Response format", "key": "output_mode", "value": "xml" } ] } }, "status": "Conflict", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"messages\": [\n {\n \"type\": \"INFO\",\n \"text\": \"\"\n },\n {\n \"type\": \"ERROR\",\n \"text\": \"\"\n }\n ]\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-8fbc8cdc-050a-49d0-81a4-c5194233d71b" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-28c96057-82ed-47e6-bc84-fdfc1f12779b" } ], "id": "b0327fe3-cd54-4077-8fdd-b80468c8e50e", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-b0327fe3-cd54-4077-8fdd-b80468c8e50e" } ], "id": "f72c5a5f-11c3-45f4-a6fd-6d600d1cf959", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-f72c5a5f-11c3-45f4-a6fd-6d600d1cf959" } ], "id": "8adbd9b8-bc5b-4039-bcac-6609c22f77ef", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-8adbd9b8-bc5b-4039-bcac-6609c22f77ef" }, { "name": "collector", "item": [ { "name": "event", "item": [ { "name": "Send Events via Http Event Collector", "id": "d7357923-4d7a-4639-981b-314964933f0a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "Authorization", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"event\": \"\",\n \"time\": \"\",\n \"host\": \"\",\n \"source\": \"\",\n \"sourcetype\": \"\",\n \"index\": \"\",\n \"fields\": {\n \"pariatur_9\": \"\",\n \"fugiat36c\": \"\",\n \"velit_f4\": \"\",\n \"fugiat_4c\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/event", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "event" ] }, "description": "Sends one or more events to Splunk via HTTP Event Collector. Events are submitted as JSON objects. Multiple events can be sent in a single request by concatenating JSON objects." }, "response": [ { "id": "3ff6e03a-6199-442a-9dfd-b572b2e01106", "name": "Events received successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"event\": \"\",\n \"time\": \"\",\n \"host\": \"\",\n \"source\": \"\",\n \"sourcetype\": \"\",\n \"index\": \"\",\n \"fields\": {\n \"pariatur_9\": \"\",\n \"fugiat36c\": \"\",\n \"velit_f4\": \"\",\n \"fugiat_4c\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/event", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "event" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-3ff6e03a-6199-442a-9dfd-b572b2e01106" }, { "id": "387b657e-52a3-4344-bf71-9d7c33d5ceb8", "name": "Invalid data format or missing required fields", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"event\": \"\",\n \"time\": \"\",\n \"host\": \"\",\n \"source\": \"\",\n \"sourcetype\": \"\",\n \"index\": \"\",\n \"fields\": {\n \"pariatur_9\": \"\",\n \"fugiat36c\": \"\",\n \"velit_f4\": \"\",\n \"fugiat_4c\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/event", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "event" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-387b657e-52a3-4344-bf71-9d7c33d5ceb8" }, { "id": "dd1db238-6ce4-48aa-8a2e-8adc84a3db4d", "name": "Token is disabled or invalid", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"event\": \"\",\n \"time\": \"\",\n \"host\": \"\",\n \"source\": \"\",\n \"sourcetype\": \"\",\n \"index\": \"\",\n \"fields\": {\n \"pariatur_9\": \"\",\n \"fugiat36c\": \"\",\n \"velit_f4\": \"\",\n \"fugiat_4c\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/event", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "event" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-dd1db238-6ce4-48aa-8a2e-8adc84a3db4d" }, { "id": "d0d14737-df26-4cf0-b300-a5c424b95351", "name": "Insufficient permissions for the token", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"event\": \"\",\n \"time\": \"\",\n \"host\": \"\",\n \"source\": \"\",\n \"sourcetype\": \"\",\n \"index\": \"\",\n \"fields\": {\n \"pariatur_9\": \"\",\n \"fugiat36c\": \"\",\n \"velit_f4\": \"\",\n \"fugiat_4c\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/event", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "event" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d0d14737-df26-4cf0-b300-a5c424b95351" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-d7357923-4d7a-4639-981b-314964933f0a" } ], "id": "ac2b8797-7a0f-427b-80f6-6866a1b617f2", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-ac2b8797-7a0f-427b-80f6-6866a1b617f2" }, { "name": "raw", "item": [ { "name": "Send Raw Data via Http Event Collector", "id": "a49ec11c-dd57-4d8b-8cd9-001ea598137c", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "Authorization", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "text/plain" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "" }, "url": { "raw": "{{baseUrl}}/services/collector/raw?channel=&sourcetype=&source=&host=&index=", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "raw" ], "query": [ { "description": "Channel identifier (GUID) for event ordering. Required if indexer acknowledgment is enabled.", "key": "channel", "value": "" }, { "description": "Override the sourcetype for the event data", "key": "sourcetype", "value": "" }, { "description": "Override the source for the event data", "key": "source", "value": "" }, { "description": "Override the host for the event data", "key": "host", "value": "" }, { "description": "Override the destination index for the event data", "key": "index", "value": "" } ] }, "description": "Sends raw event data to Splunk via HTTP Event Collector. The raw data is ingested as-is without requiring JSON formatting. Useful for log file data and other unstructured text." }, "response": [ { "id": "0d45d26e-e7f1-41c3-a73e-b0d0f0a80c77", "name": "Raw data received successfully", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "text/plain" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "" }, "url": { "raw": "{{baseUrl}}/services/collector/raw?channel=&sourcetype=&source=&host=&index=", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "raw" ], "query": [ { "description": "Channel identifier (GUID) for event ordering. Required if indexer acknowledgment is enabled.", "key": "channel", "value": "" }, { "description": "Override the sourcetype for the event data", "key": "sourcetype", "value": "" }, { "description": "Override the source for the event data", "key": "source", "value": "" }, { "description": "Override the host for the event data", "key": "host", "value": "" }, { "description": "Override the destination index for the event data", "key": "index", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-0d45d26e-e7f1-41c3-a73e-b0d0f0a80c77" }, { "id": "a468756b-2886-46a8-ad95-1dbf490b6720", "name": "Invalid request", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "text/plain" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "" }, "url": { "raw": "{{baseUrl}}/services/collector/raw?channel=&sourcetype=&source=&host=&index=", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "raw" ], "query": [ { "description": "Channel identifier (GUID) for event ordering. Required if indexer acknowledgment is enabled.", "key": "channel", "value": "" }, { "description": "Override the sourcetype for the event data", "key": "sourcetype", "value": "" }, { "description": "Override the source for the event data", "key": "source", "value": "" }, { "description": "Override the host for the event data", "key": "host", "value": "" }, { "description": "Override the destination index for the event data", "key": "index", "value": "" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a468756b-2886-46a8-ad95-1dbf490b6720" }, { "id": "17d9db37-5ef9-446b-9b55-609d811fe656", "name": "Token is disabled or invalid", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "text/plain" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "" }, "url": { "raw": "{{baseUrl}}/services/collector/raw?channel=&sourcetype=&source=&host=&index=", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "raw" ], "query": [ { "description": "Channel identifier (GUID) for event ordering. Required if indexer acknowledgment is enabled.", "key": "channel", "value": "" }, { "description": "Override the sourcetype for the event data", "key": "sourcetype", "value": "" }, { "description": "Override the source for the event data", "key": "source", "value": "" }, { "description": "Override the host for the event data", "key": "host", "value": "" }, { "description": "Override the destination index for the event data", "key": "index", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-17d9db37-5ef9-446b-9b55-609d811fe656" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-a49ec11c-dd57-4d8b-8cd9-001ea598137c" } ], "id": "341199d6-c87a-43a3-8ac3-091ac7f87934", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-341199d6-c87a-43a3-8ac3-091ac7f87934" }, { "name": "ack", "item": [ { "name": "Check Indexer Acknowledgment Status", "id": "960132e7-0458-4a49-8910-d588261821ec", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "Authorization", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"acks\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/ack", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "ack" ] }, "description": "Queries the indexer acknowledgment status for events sent via HTTP Event Collector. Returns whether events with specified ack IDs have been indexed." }, "response": [ { "id": "b0a8973b-f29f-4def-b24b-dfe048e555d5", "name": "Acknowledgment status returned", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"acks\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/ack", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "ack" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"acks\": {\n \"proidenta_0\": \"\"\n }\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-b0a8973b-f29f-4def-b24b-dfe048e555d5" }, { "id": "cf51f6dc-0d73-45f8-896e-cbca9cff733b", "name": "Invalid request format", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "Authorization", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"acks\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/services/collector/ack", "host": [ "{{baseUrl}}" ], "path": [ "services", "collector", "ack" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"text\": \"\",\n \"code\": \"\",\n \"invalid-event-number\": \"\",\n \"ackId\": \"\"\n}", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-cf51f6dc-0d73-45f8-896e-cbca9cff733b" } ], "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-960132e7-0458-4a49-8910-d588261821ec" } ], "id": "afc39e77-d2f6-4c95-8194-870d3e211174", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-afc39e77-d2f6-4c95-8194-870d3e211174" } ], "id": "96bd3de3-3466-4836-9065-657612df56af", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-96bd3de3-3466-4836-9065-657612df56af" } ], "id": "715c85f4-e879-4585-9768-3b3a430b885b", "createdAt": "2026-06-05T13:19:08.000Z", "updatedAt": "2026-06-05T13:19:08.000Z", "uid": "35240-715c85f4-e879-4585-9768-3b3a430b885b" } ], "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}", "type": "string" } ] }, "variable": [ { "key": "host", "value": "localhost" }, { "key": "port", "value": "8089" }, { "key": "baseUrl", "value": "https://{{host}}:{{port}}" } ] }