Which of the following formats are valid for a Splunk REST URI?

A valid Splunk REST API Uniform Resource Identifier (URI) follows a standard structure for accessing endpoints on a Splunk instance. This structure must include the protocol scheme (http or httpss), the hostname or IP address of the Splunk server, the management port number (default is 8089), the /services/ path prefix, and the specific endpoint path. The format scheme://host:port/services/endpoint correctly represents all these required components for a basic REST API call.

A. host:port/endpoint is incorrect because it is missing the required protocol scheme (e.g., httpss://) and the mandatory /services/ path prefix.

B. scheme://host/servicesNS// is incorrect because it omits the mandatory management :port number after the host. While servicesNS is a valid path prefix, the port is not optional.

C. $SPLUNK HOME/services/endpoint is incorrect because this represents a local file system path using an environment variable, not a network URI used for making REST API requests.

1. Splunk Enterprise Documentation

REST API User Manual

"REST API basics". The documentation specifies the URI structure for REST calls as: https://://. This directly validates the format presented in option D. The manual clarifies that is the Splunkd management port (default 8089) and is typically /services/.