topic Splunk Adaptive Response sending post command in REST API in Getting Data In

Splunk Adaptive Response sending post command in REST API

ramesh_babu71 — Wed, 29 Nov 2017 14:38:26 GMT

Hi,

I am trying to create a new app which will be used to send a Splunk Adaptive response via REST API. I am able get the response from Splunk REST API using using below code

     headers_server, content_server = rest.simpleRequest('/services/server/info?output_mode=json', sessionKey=sessionKey)

However my requirement is to convert the below curl command which has a POST action to python REST API.

curl -k -u admin:Password1 https://localhost:8089/services/data/inputs/script/restart?output_mode=json -d script=".\bin\script_test\windows.bat"

Would require you help on how to send this POST command in python REST API format.

Re: Splunk Adaptive Response sending post command in REST API

harsmarvania57 — Wed, 29 Nov 2017 15:33:22 GMT

Hi @ramesh_babu71,

Please try this python code

   rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

EDIT1: Updated code, but what you want to achieve. It seems like /services/data/inputs/script/restartgiving me HTTP 400 error with GET request but didn't tried POST request.

EDIT2: Based on this doc http://docs.splunk.com/Documentation/Splunk/6.6.4/RESTREF/RESTinput#data.2Finputs.2Fscript.2Frestart
POST request should be like

rest.simpleRequest('/servicesNS/nobody/<APPNAME>/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

Re: Splunk Adaptive Response sending post command in REST API

ramesh_babu71 — Thu, 30 Nov 2017 17:25:50 GMT

Thanks Harshil. This is what I was looking for. The POST command lets me to restart/enable the scripted input

However a slight modification was required as \b in ".\bin...."python is taken as ASCII so we have to tell python to take it as string using r in front

 rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': r".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

Re: Splunk Adaptive Response sending post command in REST API

harsmarvania57 — Thu, 30 Nov 2017 17:29:24 GMT

Great that it helped you, I have converted my comment to answer so you can accept it and thanks for the explanation about ASCII character.