API request and comparison- Can this be achieved?

[cheanaydoo]

Hello,

I have a scenario that I need to confirm if it works with splunk.

I have 2 environments

1. Cluster1 
2. Cluster2

I have the same application setup on both environments

1. Appxyz

Now I need to check that the versions of Appxyz on Cluster1 and Cluster2 are the same

and I send a curl request to https://cluster.Appxyz and https://cluster2.Appxyz

the request returns json values like name: thisname, clustername: thisclustername and version: v123 or V321.

I need to extract only the version values from the json i.e v123 or v321

where Cluster.Appxyz.version => v123 and Cluster2.Appxyz.version=> v321

In this case:

if Cluster1.Appxyz.version is != to Cluster2.Appxyz.version

throw some alert stating "mismatched versions"

if Cluster1.Appxyz.version is == to Cluster2.Appxyz.version

Can this be achieved using splunk?

Thanks

[renjith_nair]

Hi @cheanaydoo ,

It's possible. Please find below a sample

Cluster 1

{
  "name": "cluster1",
  "clustername": "cluster1_name",
  "version": "v123"
}

Cluster 2

{
  "name": "cluster2",
  "clustername": "cluster2_name",
  "version": "v321"
}

Search

index="api" sourcetype="_json"
| stats latest(version) as version by name,clustername
| stats first(version) as version1,last(version) as version2
| eval result=if(version1 == version2,"yes","no")

Output

When you compare the result, it should be based on a parameter such as common keys, timestamp etc. In the above example, we compared based on time stamp, i.e. takes the latest from both outputs and compared them.

[cheanaydoo]

Hello @renjith_nair 

Thanks very much for your response.

Will it be possible to CURL or make an API get request to retrieve the json before exracting?

Cluster 1

curl https://cluster1.Appxyz

{
  "name": "cluster1",
  "clustername": "cluster1_name",
  "version": "v123"
}

Cluster 2

curl https://cluster2.Appxyz

{
  "name": "cluster2",
  "clustername": "cluster2_name",
  "version": "v321"
}

I created a python script to do that, i.e send requests to two URL endpoint -- respond with json key/values. 

Extracted the "version" key from both responses and assert that the version values from both endpoints are the same or no.

Will splunk be able to run all the flows, starting from making the API call request? or CURL the url/endpoint? 

Thank you