topic Splunk automation in Splunk Dev

Splunk automation

sansmish — Sat, 12 Jun 2021 07:40:00 GMT

Hello everyone,

I want to automate Splunk.IF I make a dashboard manually and then I want to export it as an xml file.

After that if I make any changes in that xml file and commit the changes ,the changes should get reflected in Splunk dashboard.I don't know how to go about it .any suggestions and ideas are highly appreciated.

Thanks

Re: Splunk automation

richgalloway — Sat, 12 Jun 2021 12:46:14 GMT

I think that falls into the same category as converting an HTML dashboard back into Simple XML - it's a Hard Problem that no one has solved, yet. Your solution would have to read seemingly random XML and somehow figure out some sequence of Simple XML statements that would produce similar output. That sounds like PhD work to me. Export a dashboard then compare the Simple XML to the XML and you'll see what I mean.

Re: Splunk automation

ITWhisperer — Sat, 12 Jun 2021 12:56:44 GMT

Getting hold of the SimpleXML is simple enough - you can use the ReST API to retrieve the dashboard definition (See Tom West's video on YouTube https://www.youtube.com/watch?v=B9PuOPfdxd0&t=2858s around the 45minute mark). Getting a modified version back into splunk might be a little bit more tricky.

Re: Splunk automation

gjanders — Sun, 13 Jun 2021 05:24:34 GMT

In the version control for splunk app https://splunkbase.splunk.com/app/4355/
Or transfersplunkknowledgeobjects https://github.com/gjanders/Splunk

I have code that retrieves and posts back dashboards and other objects. Perhaps the transfer scripts might give you an idea...