Hi,
I appreciate the answers to the links below.
https://answers.splunk.com/answers/693317/does-splunk-ta-webtools-v13-provide-a-timeout-opti.html
Here are some additional questions about the Web Tools Add-on:
1. Is it possible to apply the curl command for each search result (url link)?
2. Is the proxy option (-x or --proxy) of linux curl available on the Web Tools Add-on?
I need to use the curl command for each search result, and at the same time I need access via a specific proxy.
Thank you!
Yes, you can curl for each event/row in the search pipeline. We call this use case the “streaming” use case.
An example is given in the details section of the app on splunkbase here:
https://splunkbase.splunk.com/app/4146/#/details
See the “deleting fired alerts” example and also see the syntax.
In short when you put a shear head that hands off more than 1 event to | curl, it will automatically switch to “streaming” mode.
Ex.
index=test | head 10 | curl ....
The above search would cause the curl command to iterate over each of the 10 events that come out of ‘index=test | head 10’.
How to use query to make result of below without map command ?
index=test
=> result field is "NUM"
1
2
3
|curl http://1.1.1.1/q?q=1
|curl http://1.1.1.1/q?q=2
|curl http://1.1.1.1/q?q=3
I used macro as below for this case, but it didn't apply.
Is this a new question or instructions for other users? If it’s a new question, please create a new question.
This question is an additional question for the answer above.
Okay I will try new question.
Yes, you can curl for each event/row in the search pipeline. We call this use case the “streaming” use case.
An example is given in the details section of the app on splunkbase here:
https://splunkbase.splunk.com/app/4146/#/details
See the “deleting fired alerts” example and also see the syntax.
In short when you put a shear head that hands off more than 1 event to | curl, it will automatically switch to “streaming” mode.
Ex.
index=test | head 10 | curl ....
The above search would cause the curl command to iterate over each of the 10 events that come out of ‘index=test | head 10’.
also, the proxy option is not currently available. I'll add it to the list of enhancement requests. Thanks!
I checked streaming about curl command.
Thank you for reply.
If you update about the proxy option, I will update too. Thanks!