How to apply curl to each search result (proxy option required) on Web Tools Add-on

[ssanplunk]

Hi,
I appreciate the answers to the links below.
https://answers.splunk.com/answers/693317/does-splunk-ta-webtools-v13-provide-a-timeout-opti.html

Here are some additional questions about the Web Tools Add-on:
1. Is it possible to apply the curl command for each search result (url link)?
2. Is the proxy option (-x or --proxy) of linux curl available on the Web Tools Add-on?

I need to use the curl command for each search result, and at the same time I need access via a specific proxy.

Thank you!

[ssanplunk]

How to use query to make result of below without map command ?

index=test
=> result field is "NUM"
1
2
3

|curl http://1.1.1.1/q?q=1
|curl http://1.1.1.1/q?q=2
|curl http://1.1.1.1/q?q=3

I used macro as below for this case, but it didn't apply.

• macro(1): curl http://1.1.1.1/q?q=$NUM$
• query: index=test | `macro(NUM)`
• result |curl http://1.1.1.1/q?q=NUM |curl http://1.1.1.1/q?q=NUM |curl http://1.1.1.1/q?q=NUM

[jkat54]

Is this a new question or instructions for other users? If it’s a new question, please create a new question.

[ssanplunk]

This question is an additional question for the answer above.
Okay I will try new question.

[jkat54 · Accepted solution]

Yes, you can curl for each event/row in the search pipeline. We call this use case the “streaming” use case.

An example is given in the details section of the app on splunkbase here:

https://splunkbase.splunk.com/app/4146/#/details

See the “deleting fired alerts” example and also see the syntax.

In short when you put a shear head that hands off more than 1 event to | curl, it will automatically switch to “streaming” mode.

Ex.

index=test | head 10 | curl ....

The above search would cause the curl command to iterate over each of the 10 events that come out of ‘index=test | head 10’.

[jkat54]

also, the proxy option is not currently available. I'll add it to the list of enhancement requests. Thanks!

[ssanplunk]

I checked streaming about curl command.
Thank you for reply.
If you update about the proxy option, I will update too. Thanks!