topic Re: curl in Shell Script run by splunk return empty in Getting Data In

curl in Shell Script run by splunk return empty

pdevosceazure — Sun, 05 Mar 2017 10:54:48 GMT

I am trying to get data from a third party API

so I get splunk to run this very basic script.

if I run the script in shell it works perfect.
if it is run by splunk $ip is empty

I know splunk can execute the script because I replace $(curl.... by "test" and splunk collects it OK.

splunk seams to be executing script as root because if chance my script to
whoiam
splunk returns root.

it is not just this url i tried different ones, it works in shell but it is always empty when run by splunk.

harsmarvania57 — Sun, 05 Mar 2017 14:48:40 GMT

Hi,

Can you please try below command in your script, added ().

IP=($(curl -s 'http://api.openweathermap.org/data/2.5/weather?q=london,uk≈pid=xxxxxxxxxxxxxxxxxxxxxxx'))

Thanks,
Harshil

koshyk — Sun, 05 Mar 2017 15:59:00 GMT

The best way to integrate with API is to use "REST modular Input" within splunk rather than calling a script etc.

There are some good docs out there, thus making your "splunk" application itself to handle API requests

pdevosceazure — Mon, 06 Mar 2017 10:09:55 GMT

I had seen this but could not find in in splunk any where in 6.5.
did not realise is as an add on. will try it out.