<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Log Source Health Monitoring

## Splunk Ingestion APIs

| Endpoint | Method | Purpose |
|---|---|---|
| `GET /services/data/indexes` | GET | List all indexes with stats |
| `GET /services/data/inputs/monitor` | GET | List file monitor inputs |
| `POST /services/search/jobs` | POST | Run health check searches |
| `GET /services/admin/inputstatus/TailingProcessor:FileStatus` | GET | File input status |

## Elastic Cluster Health APIs

| Endpoint | Method | Purpose |
|---|---|---|
| `GET _cat/indices` | GET | Index health and doc counts |
| `GET _cat/shards` | GET | Shard allocation and status |
| `GET _data_stream/*/_stats` | GET | Data stream ingestion stats |
| `GET _nodes/stats/ingest` | GET | Ingest pipeline metrics |

## Sentinel Ingestion APIs

| Endpoint | Method | Purpose |
|---|---|---|
| `POST /query` | POST | Run Usage table queries |
| `GET /dataSources` | GET | List connected data sources |
| `GET /dataConnectors` | GET | Connector health status |

## Monitoring Integration APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Grafana | `POST /api/alerts` | Create health alert rules |
| PagerDuty | `POST /v2/enqueue` | Trigger on-call for source failure |
| Datadog | `POST /api/v1/monitor` | Create ingestion monitors |

## Agent Script

```bash
# List source categories and thresholds
node agent.js categories

# Check individual source health
node agent.js check --source "windows-sysmon" --hours-silent 2 --volume-deviation 30 --latency-min 3 --parse-error-pct 0.5

# Generate gap report
node agent.js gaps --sources-json '[{"name":"sysmon","hours_silent":0},{"name":"firewall","hours_silent":12}]'
```
