topic Re: Can we get data from API in Splunk App on demand and without indexing it? in Getting Data In

Can we get data from API in Splunk App on demand and without indexing it?

wazuhtest — Fri, 16 Mar 2018 15:41:08 GMT

Hi,
Would it be possible to get data from an external RESTful API and draw the JSON results with Splunk element as charts or tables?
Thank you in advance

Re: Can we get data from API in Splunk App on demand and without indexing it?

starcher — Fri, 16 Mar 2018 16:50:47 GMT

Yes you can make a custom search command to fetch and enhance your search data as fields.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Aboutcustomsearchcommands

Re: Can we get data from API in Splunk App on demand and without indexing it?

wazuhtest — Fri, 16 Mar 2018 17:47:23 GMT

I appreciate so much your quick response .
After reading those documents it's not quite clear for me how to enhance the JSON results as data fields in order to draw charts or tables with them even if I make a command for fetching the data with 'wget' or 'curl'. Please, could you give me more details about it?
Thank you for your help

Re: Can we get data from API in Splunk App on demand and without indexing it?

starcher — Fri, 16 Mar 2018 18:26:29 GMT

You need to have some development skills. Preferably python. You want a streaming command to add fields to events. This is an example of adding/modifying fields on events as they pass through the command. The code to get such data from an api is additional you'd have to do.
https://github.com/georgestarcher/TA-esreplacefields/blob/master/bin/esreplacefields.py

Re: Can we get data from API in Splunk App on demand and without indexing it?

wazuhtest — Fri, 16 Mar 2018 19:56:42 GMT

Thank you so much, I will check it

Re: Can we get data from API in Splunk App on demand and without indexing it?

wazuhtest — Mon, 19 Mar 2018 11:13:52 GMT

Hi again @starcher, I've been checking out your scripts and I think there are some conceptual issues I'm still not getting. How could I retrieve those fetched jsons from the script to the Splunk app? And how could I draw, for example, a table with them if they're not indexed?
Lets say that I want to fetch data from - https://externfoo.bar/logs?page=1 when I press page 1 in the table, https://externfoo.bar/logs?page=2 when page 2 is pressed, and so. All in real time and on demand.
Thank you again for your help