topic Re: Does Splunk have production-ready REST interfaces to input data? in Getting Data In

Does Splunk have production-ready REST interfaces to input data?

mahbe — Thu, 08 Dec 2011 07:21:52 GMT

The title says it, my question is if Splunk supports REST interfaces for simply inputting data.

I read about this topic in http://splunk-base.splunk.com/answers/33/can-i-inject-events-into-splunk-via-a-script but I have no idea if this is available for productive usage meanwhile. I tried it with the current version of Splunk but my POSTed data didn't show up in Splunk.

Re: Does Splunk have production-ready REST interfaces to input data?

dmaislin_splunk — Thu, 08 Dec 2011 12:27:26 GMT

http://dev.splunk.com/view/SP-CAAADQ6

Re: Does Splunk have production-ready REST interfaces to input data?

Ayn — Thu, 08 Dec 2011 12:52:36 GMT

What are you looking to achieve by submitting these through the REST API interface rather than just, say, syslog? Authentication, encryption? You might be better off with using a forwarder that will give you this as well.

Re: Does Splunk have production-ready REST interfaces to input data?

mahbe — Thu, 08 Dec 2011 15:16:47 GMT

For system monitoring or reading logs it might be the right solution using a forwarder. But if I want to input events from within an application directly into Splunk (e.g. for application monitoring) the REST API seems to be a better choice.