Need Rest API for Cloud Search Head

Applicability

Description

As per the current need, the access to the Splunk Cloud Stack is needed via REST API.

However, it is not seen to be working by default or it might have been edited previously.

Investigation

It was found that the API access may be reviewed via  self-service the Admin Config Service (ACS) API, the only thing needed is to have access to the Stack Web GUI.

The instructions can be found here:   Splunk Cloud Self-Service: New Admin Config Service API

As the REST API access is a self-service procedure from the Web UI, in order to handle this feature the following needs to be doubled checked:
-Have Splunk Cloud Platform version 8.2.2201 or higher
-Verify the address(es) are using CIDR notation
-Hold a role that has the edit_ip_allow_list capability, including inherited roles. The sc_admin role has this capability by default
-Enable token authentication.

Resolution

Once these requirements have been checked, then the following steps can be taken to restrict the access to this feature for specific IP's:

In Splunk Web, click Settings > Server settings > IP allow list.
-If token authentication is not enabled, click "Go to tokens" page and enable token authentication. Once token authentication is enabled, return to the IP allow list management page and refresh the page.
— Now select the tab of the feature to which grant access. For example, click the "Search head UI access" tab to grant access to the search head UI.
— Click Add IP subnet.
— Enter the subnet using CIDR notation. For example 192.0.0.0/24
— Optionally, click Add IP subnet to add more subnets.
— Click Save.

**Note: if set the allow list to be 0.0.0.0/0, which means it is open for all IP's. When adding a specific IP address to an allow list open for all, ONLY the newly added address(es) will be able to connect.***

Check the link below for further information:     Configure IP allow lists using Splunk Web

For further details regarding token authentication, please visit the links below:

Set up authentication with tokens    or       Configure Splunk Cloud Platform to use SAML for authentication tokens

Important:
If there are any issues while trying to follow the steps above:
A support case should be filed to have the internal engineer to help on the process.
Have in mind the following details are needed:
A good “Maintenance Window “ time frame as well the “time zone”.
The list of IPs that need to be added to the API access.