Splunk custom rest API endpoint - get the body of http request in a POST request

eliav2 — Thu, 20 Oct 2022 17:20:06 GMT

On a Splunk custom rest API endpoint, I need to get the body of http POST request on the executed python script handling this endpoint.

the full rest.py handler script:

# rest.py from server import serverless_request from pathlib import Path from splunk.persistconn.application import PersistentServerConnectionApplication import json class App(PersistentServerConnectionApplication): def __init__(self, _command_line, _command_arg): log('init connection', _command_line, _command_arg) super(PersistentServerConnectionApplication, self).__init__() # Handle a syncronous from splunkd. def handle(self, in_string): """ Called for a simple synchronous request. in_string: request data passed in @rtype: string or dict @return: String to return in response. If a dict was passed in, it will automatically be JSON encoded before being returned. """ log(self) log(dir(self)) request = json.loads(in_string.decode()) log("request info", request) log('now proccessing request, hopefully at would be executed by flask') path_info = request['path_info'] if "path_info" in request else '/' method = request['method'] log("request", request) log('sending flask', {"path_info": path_info, method: "method"}) response = serverless_request(path_info, method) payload = response.data if type(payload) is bytes: payload = payload.decode() log('return payload from flask', payload) return {'payload': payload, 'status': 200} def handleStream(self, handle, in_string): """ For future use """ raise NotImplementedError( "PersistentServerConnectionApplication.handleStream") def done(self): """ Virtual method which can be optionally overridden to receive a callback after the request completes. """ pass

when sending a POST request over the custom endpoint with the body

{"isTimeSeriesCollection":true,"collectionName":"333","timeField":"_time","metaField":""}

I would expect the only argument 'in_string' passed to the handler function of `App.handle` to contain information about the body request, but the logs show that the value does not contain any of it:

request info {'output_mode': 'xml', 'output_mode_explicit': False, 'server': {'rest_uri': 'https://127.0.0.1:8089', 'hostname': 'ELIAVS-PC', 'servername': 'Eliavs-PC', 'guid': 'CD4B2374-0104-42C8-A069-F0115A5035DE'}, 'restmap': {'name': 'script:backend', 'conf': {'handler': 'application.App', 'match': '/backend', 'script': 'rest.py', 'scripttype': 'persist'}}, 'path_info': 'new_collection/tsdb', 'query': [], 'connection': {'src_ip': '127.0.0.1', 'ssl': False, 'listening_port': 12211}, 'session': {'user': 'eliav2', 'authtoken': 'ICvMPKZyW3OiN1FV5WE^3^YGOdqGvkpRax7DNB_C6pzoWS53mhj9yEYJH_UwrsJZEK4MH3gUAQh_DNiv0BNOsf4JkVJcjBh5yL1ni1n7LURwQ8a8c6vGvB__qfuTCcs_UIanwMQVmF'}, 'rest_path': '/backend/new_collection/tsdb', 'lang': 'en-US', 'method': 'POST', 'ns': {'app': 'darkeagle'}, 'form': []}

so how can I access the body of the json request?

I followed https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/customrestscript and various other sources to get to this point, the docs are lacking basic information.

Re: Splunk custom rest API endpoint - get the body of http request in a POST request

RaviNandasana — Fri, 22 Sep 2023 21:25:36 GMT

To get the payload in the request info you need add below lines in restmaf.conf

restmaf.conf

[script:upload_email_list] match = /data/email_sender/upload_email_list script = upload_email_list.py scripttype = persist python.version = python3 handler = upload_email_list.UploadEmailHandler passPayload = true // Used to see payload in api call output_modes = json // output in json formate passHttpHeaders = true // Used to see headers in api call passHttpCookies = true // Used to see cookies in api call

Output: request info

request info {'output_mode': 'xml', 'output_mode_explicit': False, .... .... 'payload':'{"fileContent":"ravinandasana1998@gmail.com,ravisheart123@gmail.com"}' ..... }

topic Splunk custom rest API endpoint - get the body of http request in a POST request in Splunk Enterprise

Splunk custom rest API endpoint - get the body of http request in a POST request

Re: Splunk custom rest API endpoint - get the body of http request in a POST request