All Apps and Add-ons

Splunk stream forwarder : client side configuration to intercept loaded jsons ?


Hello fellow splunkers !

Problem : using an internal wbesite of the company I'm working for, I have to check several values in a webpage to take a decision. All of them are loaded trough json, while I'm browsing. Manual check is quite long, and i'm trying to automate it.

Solution I came up with :

I'm trying to use splunk, with the app splunk stream installed to catch json answers from the website, using a forwarder installed on the client side (windows, navigating with firefox). The aim is to catch json answers loaded by the client while the user (Me) is browsing on a specific website. jsons are loaded depending on user actions on the website (probably loaded by a java or flash app). I can see them loaded in the firefox Network console (Json answers, XHR)

I don't want to change the way jsons are loaded. I'm not trying to change them on-the-fly. I just want to be able to index them, to read them, and use them in a real time dashboard, in a "complex spl dashboard".

Troubles :

I have installed the splunk stream app, and enabled the http collector. I can see data indexed, based on websites browsed, using this request :

index=* source=stream:* _raw=*target_website* source="stream:http"

But in all lines, I can't find a sign of the jsons I'm looking for. I'm a sysadmin, I'm not a http client/server specialist. I Think I'm missing something here.

I have all rights on the client side computer, but I can't touch anything on the webserver, neither in the webapp ...
I'm thinking the setup a local proxy, and index the "proxied" jsons ...
Any solution will do. Performance is not the aim. Any help would be greatly appreciated.

Thank you for reading.

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...