Alerting

API request and comparison- Can this be achieved?

cheanaydoo
Explorer

Hello,

I have a scenario that I need to confirm if it works with splunk.

I have 2 environments

  1. Cluster1 
  2. Cluster2

I have the same application setup on both environments

  1. Appxyz

Now I need to check that the versions of Appxyz on Cluster1 and Cluster2 are the same

and I send a curl request to https://cluster.Appxyz and https://cluster2.Appxyz

the request returns json values like name: thisname, clustername: thisclustername and version: v123 or V321.

I need to extract only the version values from the json i.e v123 or v321

where Cluster.Appxyz.version => v123 and Cluster2.Appxyz.version=> v321

In this case:

if Cluster1.Appxyz.version is != to Cluster2.Appxyz.version

throw some alert stating "mismatched versions"

if Cluster1.Appxyz.version is == to Cluster2.Appxyz.version

Can this be achieved using splunk?

 

Thanks

Labels (3)
0 Karma

renjith_nair
Legend

Hi @cheanaydoo ,

It's possible. Please find below a sample

Cluster 1

{
  "name": "cluster1",
  "clustername": "cluster1_name",
  "version": "v123"
}

Cluster 2

{
  "name": "cluster2",
  "clustername": "cluster2_name",
  "version": "v321"
}

 

Search

index="api" sourcetype="_json"
| stats latest(version) as version by name,clustername
| stats first(version) as version1,last(version) as version2
| eval result=if(version1 == version2,"yes","no")

 

Output

clusters_output.jpg

When you compare the result, it should be based on a parameter such as common keys, timestamp etc. In the above example, we compared based on time stamp, i.e. takes the latest from both outputs and compared them.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

cheanaydoo
Explorer

Hello @renjith_nair 

 

Thanks very much for your response.

Will it be possible to CURL or make an API get request to retrieve the json before exracting?

Cluster 1

 

curl https://cluster1.Appxyz

{
  "name": "cluster1",
  "clustername": "cluster1_name",
  "version": "v123"
}

 

Cluster 2

 

curl https://cluster2.Appxyz

{
  "name": "cluster2",
  "clustername": "cluster2_name",
  "version": "v321"
}

 

I created a python script to do that, i.e send requests to two URL endpoint -- respond with json key/values. 

Extracted the "version" key from both responses and assert that the version values from both endpoints are the same or no.

Will splunk be able to run all the flows, starting from making the API call request? or CURL the url/endpoint? 

 

Thank you

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...