All Apps and Add-ons

How to send a CSV file to Splunk via TCP from a Python script in Webhooks Input?

skhedim
Explorer

Hello,

I would like to send a CSV file to Splunk, I would like to send it via a TCP request, from a python script.

I have the webhook input module, but it only seems to work with JSON. I tried with TCP input. but headers are not recognized as such, and I can't reconstruct the CSV array. Here is the python code used:

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((SPLUNK, PORT))
s.send(my_csv)

Is there a way to correctly send CSV file via python from a socket, or another method?

I specify that my CSV file manually imported into Splunk works. I also configured TCP input with as source type CSV, and app context = computing (I don't know what this corresponds to)

Finally is it possible to use webhook input with CSV and how do I do it in python?
This python code worked perfectly for sending JSON.

response = requests.post( 
    splunk_webhook, data=format(my_JSON), 
    headers={'Content-Type':'application/json'} 
)   

Thank you in advance.

Sincerely

0 Karma

skhedim
Explorer

Thanks starcher ! I'm gonna do it this way.

I just need to know the roles needed to access HEC from the web interface to make the request to the dedicated team.

Do you know the roles needed to configure and generate tokens from the splunk enterprise web interface?

thank you

0 Karma

starcher
Influencer

Read your file in python, send to Splunk via http event collector.
Best to keep it json within python and send it that way.
https://github.com/georgestarcher/Splunk-Class-httpevent

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...