Alerting

API request and comparison- Can this be achieved?

cheanaydoo
Explorer

Hello,

I have a scenario that I need to confirm if it works with splunk.

I have 2 environments

  1. Cluster1 
  2. Cluster2

I have the same application setup on both environments

  1. Appxyz

Now I need to check that the versions of Appxyz on Cluster1 and Cluster2 are the same

and I send a curl request to https://cluster.Appxyz and https://cluster2.Appxyz

the request returns json values like name: thisname, clustername: thisclustername and version: v123 or V321.

I need to extract only the version values from the json i.e v123 or v321

where Cluster.Appxyz.version => v123 and Cluster2.Appxyz.version=> v321

In this case:

if Cluster1.Appxyz.version is != to Cluster2.Appxyz.version

throw some alert stating "mismatched versions"

if Cluster1.Appxyz.version is == to Cluster2.Appxyz.version

Can this be achieved using splunk?

 

Thanks

Labels (3)
0 Karma

renjith_nair
Legend

Hi @cheanaydoo ,

It's possible. Please find below a sample

Cluster 1

{
  "name": "cluster1",
  "clustername": "cluster1_name",
  "version": "v123"
}

Cluster 2

{
  "name": "cluster2",
  "clustername": "cluster2_name",
  "version": "v321"
}

 

Search

index="api" sourcetype="_json"
| stats latest(version) as version by name,clustername
| stats first(version) as version1,last(version) as version2
| eval result=if(version1 == version2,"yes","no")

 

Output

clusters_output.jpg

When you compare the result, it should be based on a parameter such as common keys, timestamp etc. In the above example, we compared based on time stamp, i.e. takes the latest from both outputs and compared them.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

cheanaydoo
Explorer

Hello @renjith_nair 

 

Thanks very much for your response.

Will it be possible to CURL or make an API get request to retrieve the json before exracting?

Cluster 1

 

curl https://cluster1.Appxyz

{
  "name": "cluster1",
  "clustername": "cluster1_name",
  "version": "v123"
}

 

Cluster 2

 

curl https://cluster2.Appxyz

{
  "name": "cluster2",
  "clustername": "cluster2_name",
  "version": "v321"
}

 

I created a python script to do that, i.e send requests to two URL endpoint -- respond with json key/values. 

Extracted the "version" key from both responses and assert that the version values from both endpoints are the same or no.

Will splunk be able to run all the flows, starting from making the API call request? or CURL the url/endpoint? 

 

Thank you

 

 

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...