All Apps and Add-ons

Can I post a CSV file to my remote search head?

svemuric
Engager

Is there any way to post my local CSV file into Remote searchhead using REST call CURL user:password ?

0 Karma

vasanthmss
Motivator

As per my understanding, There is no such out of the box functionality to post csv file to remote search head.

Dynamic lookup update from remote Workaround would be use KV Store lookup and REST API to handle it. However you may need a script to handle the csv read and post the data. You have to create the kv-lookup file manually with fields to refer the collection.

Note: you can use "batch_save" to post multiple records but the limitation is 1000 records per POST

You can create, read, update, delete, and manage KV Store data and collections using the Splunk REST API, which you access on the Splunk management port (the default port is 8089).

Sample:
curl -k -u admin:yourpassword -d name=kvstorecoll https://localhost:8089/servicesNS/nobody/search/storage/collections/config
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/config/kvstorecoll -d 'field.id=number' -d 'field.name=string' -d 'field.address=string' -d 'accelerated_fields.my_accel={"id": 1}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll -H 'Content-Type: application/json' -d '{"name": "Splunk HQ", "id": 123, "address": { "street": "250 Brannan Street", "city": "San Francisco", "state": "CA", "zip": "94107"}}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll/batch_save -H 'Content-Type: application/json' -d '[{"name": "Splunk Sweden"}, {"name": "Splunk Singapore"}]'

Link: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG

Hope this helps you!!!

V
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...