¿how to get data from facebook api to splunk?

[jperezh]

I'm new to splunk and I wanted to know how to get data from the facebook api to splunk. I have read that there was an app for splunk but it got removed, also that there is a way to do it by using the REST api but I don't understand how does it work.

Thanks

P.D

There are python scripts that scrap facebook, can I use one of them to send the data to Splunk? how do I do it?

[jperezh]

I haven't been able to input data from the SPLUNK REST_API bu i have this is script that fetch the data and allow me to store it in a variable or a file like json or csv. I want to know if its possible to send the variable or the data stream directly to Splunk as individual events. Heres is my code:

from facepy import GraphAPI
import urllib



access = 'token'

graph = GraphAPI(access)
page_id= 'id'
datas= graph.get(page_id+'/posts?fields=message,likes, name', page=True, retry=5, limit=2)

posts=[]

for data in datas:
    posts.append(data)

the question is, how can I send the data to splunk as individual events, one for each post for example.

[lukas_loder]

Hi jperezh

I'm indexing for example the number of likes of our facebook group. For this you need to have access to your GraphApi from Facebook. There you need to create an API key which is allowed to read this information.
Than I'm using the REST Api Modular Input (https://splunkbase.splunk.com/app/1546/) with following configuration:

Endpoint URL: https://graph.facebook.com/v2.5/me?fields=likes&access_token=YOURTOKEN
Http Method: Get
Authentication Type: None
Response Type: json

What kind of information do you want to load from Facebook? And are you the owner from the group?

[jperezh]

Hi lukas.loder, thanks for replying. I'm interested in comments, user who comment, and likes. For now I'm aiming to do it with my own personal page, I have already set an input with the REST API:
Endpoint url: https://graph.facebook.com/v2.6/JuanJP88/feed?fields=from,message,created_time,id,actions,event,comm...
Http Method: Get
Authentication Type: None
Response Type: json
But after that I don't know what to do.