topic Which training course should I take if I want to learn how create Splunk Apps that connect to outside APIs? in Training + Certification Discussions

Which training course should I take if I want to learn how create Splunk Apps that connect to outside APIs?

summitsplunk — Thu, 08 Mar 2018 22:00:50 GMT

My IT shop uses a lot of SAAS and IAAS services.

Examples:
GSuite
MimeCast
AWS

If I wanted to learn how to ingest data from Google for example via their API and make it a Splunk App, Where would I start?

IE Would I start by: Learning Python, Learning Splunk SPL, Learning about APIs? Is there a particular course Splunk offers that would help get to the point where I can write a Splunk app, for example that pulls data from a google API.

I am not a developer so this concept is very daunting for me.

Re: Which training course should I take if I want to learn how create Splunk Apps that connect to outside APIs?

MuS — Thu, 08 Mar 2018 22:19:48 GMT

Hi summitsplunk,

to be honest: I don't think any of the Splunk training will cover that.

You best option is to check the Splunk DEV portal:
http://dev.splunk.com
http://dev.splunk.com/view/get-started/SP-CAAAESC
and the docs page on modular inputs which handles a Twitter API example https://docs.splunk.com/Documentation/Splunk/7.0.2/AdvancedDev/ModInputsDevTools

There is also no specific order to learn these topics, just start and try it - we all started once 😉

Regarding python, just use Google to 'learn' or https://www.python.org/about/gettingstarted/ or a fun way to learn is the Python challenge here http://www.pythonchallenge.com

Hope this helps ...

cheers, MuS

Re: Which training course should I take if I want to learn how create Splunk Apps that connect to outside APIs?

damiensurat — Thu, 08 Mar 2018 22:32:59 GMT

I would start by leveraging some of the free apps that are already available in splunk, like:
EG:
Splunk Add on Builder: This app helps you to connect to various source data via Splunk's GUI.
Splunk App for AWS
Google Apps for Splunk

Go to Splunkbase and see if there is an existing app available:
https://splunkbase.splunk.com/

If so, install it on a splunk dev instance and see if you can leverage the prebuilt app to meet your needs...

You can always navigate to the splunkhome\etc\apps\your installed app folder to see how the app is built an leverage any scripts, inputs, etc already created in the app to help in building your own.

As for the courses, I would get the basic understanding of what an API is and how to connect to it to get data back down first.

Here's some material on how to get data out of googles API using python.
https://developers.google.com/sheets/api/quickstart/python