topic How to send curl request from Splunk dashboard? in Splunk Enterprise

How to send curl request from Splunk dashboard?

mottig — Mon, 12 Sep 2022 13:12:20 GMT

Hi,

I am a new to spunk.

I am trying to send an REST request from splunk dashboard by a submit button to external server that listens http requests.

How can i achieve that goal? I basically need to send a simple curl with a var in the path that will be selected by the user from a drop down list.

Re: How to send curl request from Splunk dashboard?

bowesmana — Tue, 13 Sep 2022 01:20:00 GMT

Take a look at this addon

https://splunkbase.splunk.com/app/4146/

Re: How to send curl request from Splunk dashboard?

mottig — Tue, 13 Sep 2022 05:34:27 GMT

Thank you for your answer.

Im not sure this addon is what I need.

This addon is allowing to have curl sending abilities in SPL. I need to send an API from a button in a dashboard

that is not related to to the data.

For example I want to notify my backend server to start send me events from a certain type(that will be define as a strings in another drop down list).

Re: How to send curl request from Splunk dashboard?

chaker — Tue, 13 Sep 2022 06:02:21 GMT

Without fully understanding what you are trying to achieve, you can try using the solution below to run the SPL command that @bowesmana suggested add-on offers, or perhaps this may give you other ideas to solve the problem.

https://community.splunk.com/t5/Dashboards-Visualizations/Button-to-run-splunk-query/m-p/454739/highlight/true#M29819

Re: How to send curl request from Splunk dashboard?

bowesmana — Tue, 13 Sep 2022 06:05:56 GMT

That is exactly what you can do with the add on.

Effectively the button can set a token and then the SPL containing the curl command can execute and notify your backend server to perform whatever you need it to.

In Splunk everything is a search, so you will just have a hidden search that is dependent on the token that can be set by the button. Clicking the button will set the token, causing the SPL to run.

See the Custom Token Links example in the Splunk Dashboard Examples app, which shows you how to do buttons/tokens.

Then your SPL would be something like this, where the curl_button_token token is set by the button and cleared again when the search has run.