topic Re: Making HTTP get requests with splunk in Getting Data In

Making HTTP get requests with splunk

nikhilnsr1998 — Wed, 08 Sep 2021 20:43:10 GMT

How can i create a scheduled report that runs every hour and makes GET requests to fetch data from an open source.

basically querying the same page and updating latest data available on premises.

Re: Making HTTP get requests with splunk

richgalloway — Wed, 08 Sep 2021 21:30:45 GMT

There probably are several apps on splunkbase that can help with that.

Re: Making HTTP get requests with splunk

nikhilnsr1998 — Wed, 08 Sep 2021 22:41:35 GMT

could you please share a few?

thanks

Re: Making HTTP get requests with splunk

bowesmana — Wed, 08 Sep 2021 23:17:47 GMT

Try the webtools app - not supported in Splunk Cloud

https://splunkbase.splunk.com/app/4146/

Re: Making HTTP get requests with splunk

nikhilnsr1998 — Thu, 09 Sep 2021 09:53:25 GMT

thanks for the help. This seems to be correct, can you please help out on one other problem

within the webtools application i ran below query to fetch data from rapidapi :

| curl method=GET user=<splunk_username>pass=<splunk_password> headerfield= {
'x-rapidapi-host': "community-open-weather-map.p.rapidapi.com",
'x-rapidapi-key': "<apikey-from-rapidapi>"
}
data={"q":"London,uk","lat":"0","lon":"0","callback":"test","id":"2172797","lang":"null","units":"imperial","mode":"json"} uri="https://community-open-weather-map.p.rapidapi.com/weather"

I am getting below results (pfa screenshot)

Re: Making HTTP get requests with splunk

bowesmana — Mon, 13 Sep 2021 01:30:38 GMT

See the example of using custom headers here

https://splunkbase.splunk.com/app/4146/#/details

headerfield option takes a field name, not a string - in any case, you need to quote the entire JSON payload and escape the doublequoted JSON fieldnames and values.

add the debug=t option to the curl query and you will get some feedback