Hello all,
I have a requirement to forward events from a search result to an API and store the response from the API call made by an alert action back to a custom index. How can I achieve this. Please help.
Regards,
Naresh
Looks like the only way is to use HEC method to make an API call back to store the data in to an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature OOB on its future version.
Regards,
Naresh
Looks like the only way is to use HEC method to make an API call back to store the data in to an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature OOB on its future version.
Regards,
Naresh
I think you've asked this question before. I don't have experience with the SDK so I can't help in that area.
Sounds like you need a custom search command. See https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Aboutcustomsearchcommands
@richgalloway I have built an addon to create an alert action where My API call works. Once the call gets completed the API responds with a JSON data which I want to store on a custom index. Currently, it stores the data by default into the Main index which we don't want to use.
I used the following code using the Splunk add-on builder to write it but it writes the data into the Main index.
helper.addevent("hello", sourcetype="customsource")
helper.addevent("world", sourcetype="customsource")
helper.writeevents(index="mycustomindex", host="localhost", source="localhost")
How to proceed further.
Hi @nareshkumarg,
Did you find a solution to the above? If so, could you please let me know what you found?