How to write API results made by splunk Alert action to a custom index

[nareshkumarg]

Hello all,

I have a requirement to forward events from a search result to an API and store the response from the API call made by an alert action back to a custom index. How can I achieve this. Please help.

Regards,

Naresh

[nareshkumarg · Accepted solution]

Looks like the only way is to use HEC method to make an API call back to store the data in to an index we want. Kind of a pain but this what I got from Splunk support. I wonder whether Splunk will add this feature OOB on its future version.

Regards,

Naresh

[richgalloway]

I think you've asked this question before.  I don't have experience with the SDK so I can't help in that area.

[richgalloway]

Sounds like you need a custom search command.  See https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/Aboutcustomsearchcommands

[nareshkumarg]

@richgalloway I have built an addon to create an alert action where My API call works. Once the call gets completed the API responds with a JSON data which I want to store on a custom index. Currently, it stores the data by default into the Main index which we don't want to use.

I used the following code using the Splunk add-on builder to write it but it writes the data into the Main index.

helper.addevent("hello", sourcetype="customsource")
helper.addevent("world", sourcetype="customsource")
helper.writeevents(index="mycustomindex", host="localhost", source="localhost")

How to proceed further.

[AMAN0113]

Hi @nareshkumarg,

Did you find a solution to the above? If so, could you please let me know what you found?