topic Re: can splunk pull in data via rest in Getting Data In

can splunk pull in data via rest

a212830 — Thu, 08 May 2014 10:46:47 GMT

Hi,

Is there anyway Splunk can pull in data dynamically via REST? Looking for something similar to db connect dbquery - "rest_call ...endpoint" and display the data, but not index it.

Re: can splunk pull in data via rest

a212830 — Sat, 10 May 2014 12:37:08 GMT

Anyone? Anyone? Bueller?

We are trying to make our Splunk a central place for triage, and while we get a lot of logs and data already, some of it isn't indexed (and shouldn't be), and is only available via REST API's. If we could pull this in to view, it would complete the picture.

Re: can splunk pull in data via rest

dwaddle — Sat, 10 May 2014 13:53:42 GMT

I don't think there's anything exactly like what you want.

There's http://apps.splunk.com/app/1546/ - which is a modular input extension to Splunk that does REST calls against an endpoint and indexes the results. Splunk makes the call to the remote endpoint periodically. I know you didn't want to index the data, so this is probably not what you want.

Similarly, you can use one of Splunk's REST endpoints to submit new events. See http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#receivers.2Fsimple . This also indexes the data, so it's not exactly what you're looking for.

At this point, having given you two non-options, I would suggest you look at implementing your own custom search command. In this way, you write a script that makes the necessary API calls and configure splunk to make it available as a search command. It's not too bad. See http://docs.splunk.com/Documentation/Splunk/6.0.3/Search/Writeasearchcommand