Is it possible to chain API calls so I can use a field from a previous API

[mninansplunk]

Hello,

I am struggling on figuring out how this request can be achieved.  I need to report on events from an API call in Splunk, However, the API call requires variables from another API call.  I have been testing with the Add-On Builder and can make the initial request.  I'm seeing the resulting events in Splunk Search, but I can't figure out how to create a secondary API call that could use the fields as variables in the secondary args or parameters fields.

I was trying to use the API module, because I'm not fluent at all with scripting.

Thanks for any help on this, it is greatly appreciated,

Tom

[kprior201]

Okay, so it looks like you're getting a list of dictionaries returned, so it shouldn't be too hard for us to figure this out. I'm not an expert code writer, by any means, but I've messed around with it enough to be able to troubleshoot at least, so I'll try to help.

You should be able to do something like this where 'example' is the response from the previous call:

for x in example:
    for k, v in x:
        if k == 'name':
            server_name = v
            url='https://su-ns-vpx-int-1.siteone.com/nitro/v1/config/lbvserver_servicegroup_binding/' + server_name
            <create API call here using new url>

[kprior201]

Hello!

If I'm understanding you right (and assuming you're using requests), you should be able to assign your API call to a variable and then call the variable.content in order to access what the results from the call are. The below, when I tested it, returned a dictionary of the results. From there, you should be able to parse out the variable that you're reassigning.

Example:

req = requests.post(url, json=payload, headers=headers)
data = requests.content

[mninansplunk]

Thank you for your help, Sorry, I am not very familiar at all with coding.  I am struggling thru the Python script, but making progress.  So the first API call I need to make is:

"https://ServerName/nitro/v1/config/lbvserver"

This gives me a JSON return with about 50  name values like:

[
{
"name":"server1",
"insertvserveripport":"OFF",
},
{
"name":"server2",
"insertvserveripport":"OFF",

},

I need to make a secondary API call that would use these names in the API URL, like:

https://su-ns-vpx-int-1.siteone.com/nitro/v1/config/lbvserver_servicegroup_binding/(name)

I can't figure out how to capture the name values from the first API call in order for the second API call to be executed for each variable. : (   I hope that makes sense. 🙂 

Here's the actual code I am using:

import os
import sys
import time
import datetime
import json

'''
    IMPORTANT
    Edit only the validate_input and collect_events functions.
    Do not edit any other part in this file.
    This file is generated only once when creating the modular input.
'''
'''
# For advanced users, if you want to create single instance mod input, uncomment this method.
def use_single_instance_mode():
    return True
'''

def validate_input(helper, definition):
   """Implement your own validation logic to validate the input stanza configurations"""
    # This example accesses the modular input variable
    # global_account = definition.parameters.get('global_account', None)
   pass

def collect_events(helper, ew):


    # Note, for single instance mod input, args will be returned as a dict.
    # For multi instance mod input, args will be returned as a single value.
    opt_global_account = helper.get_arg('global_account')

    global_userdefined_global_var = helper.get_global_setting("userdefined_global_var")


    # The following examples send rest requests to some endpoint.
    url="https://servername.com/nitro/v1/config/lbvserver"
    headers = {"authorization":"Basic bnNyb2dghdg90O0c2NsciEh"}
    final_result = []
    response = helper.send_http_request(url, 'GET', parameters=None, payload=None,headers=headers, cookies=None, verify=True, cert=None,timeout=None, use_proxy=True)

    # get response body as json. If the body text is not a json string, raise a ValueError
    r_json = response.json()
    for name in r_json["lbvserver"]:
        state = helper.get_check_point(name["name"])
        if state is None:
            final_result.append(name)
            helper.save_check_point(name["name"], "Indexed")
        helper.delete_check_point(name["name"])
    

    # get response status code
    r_status = response.status_code
    if r_status !=200:
        # check the response status, if the status is not sucessful, raise requests.HTTPError
        response.raise_for_status()



    # To create a splunk event
    event = helper.new_event(json.dumps(final_result), time=None, host=None, index=None, source=None, sourcetype=None, done=True, unbroken=True)
    ew.write_event(event)
    

Thanks again for responding, very much appreciated. 🙂

Thanks,

Tom