topic API request and comparison- Can this be achieved? in Alerting

API request and comparison- Can this be achieved?

cheanaydoo — Mon, 17 Oct 2022 14:28:00 GMT

Hello,

I have a scenario that I need to confirm if it works with splunk.

I have 2 environments

Cluster1
Cluster2

I have the same application setup on both environments

Appxyz

Now I need to check that the versions of Appxyz on Cluster1 and Cluster2 are the same

and I send a curl request to https://cluster.Appxyz and https://cluster2.Appxyz

the request returns json values like name: thisname, clustername: thisclustername and version: v123 or V321.

I need to extract only the version values from the json i.e v123 or v321

where Cluster.Appxyz.version => v123 and Cluster2.Appxyz.version=> v321

In this case:

if Cluster1.Appxyz.version is != to Cluster2.Appxyz.version

throw some alert stating "mismatched versions"

if Cluster1.Appxyz.version is == to Cluster2.Appxyz.version

Can this be achieved using splunk?

Thanks

Re: API request and comparison

renjith_nair — Sat, 15 Oct 2022 03:19:01 GMT

Hi @cheanaydoo ,

It's possible. Please find below a sample

Cluster 1

{ "name": "cluster1", "clustername": "cluster1_name", "version": "v123" }

Cluster 2

{ "name": "cluster2", "clustername": "cluster2_name", "version": "v321" }

Search

index="api" sourcetype="_json" | stats latest(version) as version by name,clustername | stats first(version) as version1,last(version) as version2 | eval result=if(version1 == version2,"yes","no")

Output

clusters_output.jpg

When you compare the result, it should be based on a parameter such as common keys, timestamp etc. In the above example, we compared based on time stamp, i.e. takes the latest from both outputs and compared them.

Re: API request and comparison

cheanaydoo — Sat, 15 Oct 2022 04:18:30 GMT

Hello @renjith_nair

Thanks very much for your response.

Will it be possible to CURL or make an API get request to retrieve the json before exracting?

Cluster 1

curl https://cluster1.Appxyz { "name": "cluster1", "clustername": "cluster1_name", "version": "v123" }

Cluster 2

curl https://cluster2.Appxyz { "name": "cluster2", "clustername": "cluster2_name", "version": "v321" }

I created a python script to do that, i.e send requests to two URL endpoint -- respond with json key/values.

Extracted the "version" key from both responses and assert that the version values from both endpoints are the same or no.

Will splunk be able to run all the flows, starting from making the API call request? or CURL the url/endpoint?

Thank you