Splunk REST API returning authentication error

Question

I am trying to use splunk REST APIs to check if any alerts are triggered. I have gone through a lot of documentation and have realized that a command like

curl -k -u username:pass \
 https://<splunkserverdomain.com>/en-US/splunkd/servicesNS/<username>/<appname>/alerts/fired_alerts \
 -d "output_mode=json" --get 

should work. However i always get a 401 authentication error.

Do i have to create a different user for the APIs? if yes how? I have used multiple URLs, all those that i could find in the documentation. All result in either redirects or 401s.

P.S. The username and the password is correct, I can log in to the Web UI using these credentials

Answer 1

The problem was occurring because of the wrong server being used. Fixed after correcting that.

Answer 2

You probably need to go to 8089 the splunkd port. Also I found I was getting unauthorised using the 'admin' user but when I created my own with its own group giving it (admin, can_delete, power, splunk-system-role, user) privilages... I was able to get results using that... for example...

.\curl.exe -u bob:bob -k https://127.0.0.1:8089/servicesNS/nobody/search/saved/searches