topic Re: Injest JSON document returned from an monitoring endpoint in Getting Data In

Injest JSON document returned from an monitoring endpoint

givanov — Tue, 02 Oct 2012 20:21:08 GMT

Hello,

I'm having a service which exports monitoring data through a JSON endpoint. Is it possible to have Splunk call that endpoint and injest the returned JSON document?

Thank you,
- George

Re: Injest JSON document returned from an monitoring endpoint

dwaddle — Tue, 02 Oct 2012 23:13:08 GMT

Yes, use a scripted input. Splunk calls your script on an interval and your script makes the call to you service and emits the results on stdout which Splunk then indexes.

Re: Injest JSON document returned from an monitoring endpoint

nicholasgrabows — Thu, 27 Dec 2012 20:07:29 GMT

You could also try this a new splunkbase app called "importutil". It lets you import input from an http, ftp, or sftp url via the splunk search command line. sftp is experimental.

http://splunk-base.splunk.com/apps/69078/importutil

Here is an http example that imports data from the federal reserve economic data website:

|importutil http http://research.stlouisfed.org/fred2/data/PAYEMS.csv
| multikv
| table DATE, VALUE

Set this up as a scheduled search. So it will hit the URL periodically.