topic Re: How to connect to a cloud based application to pull logs into Splunk via REST API? in Getting Data In

How to connect to a cloud based application to pull logs into Splunk via REST API?

sbattista09 — Fri, 10 Jun 2016 14:10:30 GMT

What would the steps be to connect to a cloud based application to pull logs via API into Splunk? I am trying to learn how to use this function of Splunk and not sure where to start and the documentation is a little hard to follow. Keep in mind I am not a programmer.

Re: How to connect to a cloud based application to pull logs into Splunk via REST API?

richgalloway — Fri, 10 Jun 2016 14:18:07 GMT

Have a look at the REST API Modular Input app (https://splunkbase.splunk.com/app/1546/#/documentation ). It will do most of the heavy lifting for you, but you may need to do some programming yourself (or get some help).

Re: How to connect to a cloud based application to pull logs into Splunk via REST API?

woodcock — Mon, 13 Jun 2016 16:27:32 GMT

You would not use REST API for that, you would use Http Event Collector (HEC):
http://dev.splunk.com/view/event-collector/SP-CAAAE6M

Re: How to connect to a cloud based application to pull logs into Splunk via REST API?

richgalloway — Tue, 14 Jun 2016 13:10:17 GMT

The OP said he wanted to "pull" logs into Splunk, which I take to mean "do something on the Splunk server to get my cloud logs indexed". That's why I suggested the REST app.
The HEC would be the way to go if the cloud app was pushing logs into Splunk and could be modified to use HEC.

Re: How to connect to a cloud based application to pull logs into Splunk via REST API?

woodcock — Tue, 14 Jun 2016 13:52:18 GMT

There is no clientless way to pull anything anywhere so I assumed he mis-spoke and that he needs a clientless push.

Re: How to connect to a cloud based application to pull logs into Splunk via REST API?

adnankhan5133 — Tue, 26 Jun 2018 20:58:55 GMT

Is there a specific method to pull Oracle Cloud Platform logs into Splunk? Would this require using REST API's or the HTTP Event Collector?

Re: How to connect to a cloud based application to pull logs into Splunk via REST API?

larryleeroberts — Thu, 16 Jan 2020 14:17:04 GMT

It seems really strange to me that Splunk has yet to offer a method to "pull". Recently, Dynatrace made the Dynatrace SaaS logs available through their API. I want to pull these into Splunk. I agree with Rich that it looks like the only way to do this is through the API and writing something on your own to execute the pull.