All Apps and Add-ons

Cannot export data after creating custom Splunk App Add-on

revin
Splunk Employee
Splunk Employee

Hi,

I got 1 question:

Since I cannot find the Autobahn Security (World most impactful web vulnerability scan engine) app in Splunkbase, I create custom Splunk app add-on for API integration. We have a plan to integrate our API engine and have the data exported to splunk for our client that uses splunk. 

We want to see the data vulnerability point, create an add-on to Splunk base, but it's hard to display in Splunk. How to push the data from the our software, integrated to Splunk?

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @revin,

this isn't a question for Splunkers but for Autobahn Security people.

In Splunk you have many methods to ingest data, the main (but not the only) are:

  • reading a file,
  • from syslog,
  • from a scripted input using API.

So the real question is: : which are the methods to extract logs from this technology?

Knowing ths you can choose the method you like.

If possible, monitor a file using a Universal Forwarder is prefereable, but I don't know if it's possible to install a UF on Autobahn Security, otherwise, as you said, you could create a script that calls via API the Autobahn Security server and extract data sending them to Splunk.

When you fould the method to extract data from Autobahn Security, you can store them in an index (called e.g. Autobahn_Security) and then search them in Splunk using a very easy search:

index=Autobahn_Security
| table *

 The scipt and the input that call it must be in the Technical Add_On.

Here you can find infos about scripted inputs https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup and in google you can find also many training videos.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @revin,

this isn't a question for Splunkers but for Autobahn Security people.

In Splunk you have many methods to ingest data, the main (but not the only) are:

  • reading a file,
  • from syslog,
  • from a scripted input using API.

So the real question is: : which are the methods to extract logs from this technology?

Knowing ths you can choose the method you like.

If possible, monitor a file using a Universal Forwarder is prefereable, but I don't know if it's possible to install a UF on Autobahn Security, otherwise, as you said, you could create a script that calls via API the Autobahn Security server and extract data sending them to Splunk.

When you fould the method to extract data from Autobahn Security, you can store them in an index (called e.g. Autobahn_Security) and then search them in Splunk using a very easy search:

index=Autobahn_Security
| table *

 The scipt and the input that call it must be in the Technical Add_On.

Here you can find infos about scripted inputs https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup and in google you can find also many training videos.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @revin,

happy splunking!

Ciao.

Giuseppe

P.S.: karma Points are appreciated 😉

Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...