Splunk Dev

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

chasrini
New Member

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

Labels (3)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Simplest solution is execute an inputlookup command and parse the search results

View solution in original post

0 Karma

starcher
SplunkTrust
SplunkTrust

Simplest solution is execute an inputlookup command and parse the search results

0 Karma

chasrini
New Member

Thanks for the update. They have kept the lookup csv file in a custom app. Its not on the "Search & Reporting" app. so I am not able to fetch the CSV result from that app. I tried using python like below but it returned resp code 200 and not the data present in CSV file. Is there any function or method thru which I can get the CSV file info.

import json
import csv
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

splunkApp = "splunk_xxx"
splunkUser = "xx"
splunkPwd = "xx"
splunkURI = "https://splunkxx.trusted.xxx.com:port/en-US/manager/splunk_xx/data/lookup-table-files"
lookupName = "xx.csv"
lookupUpdateURI = "%s/%s" % (splunkURI, lookupName)

headers = {'Content-Type': 'application/json'}
data = {"eai:data" : "/opt/splunk/sh/splunk/etc/apps/splunk_xx/lookups/xx.csv"}
r = requests.get(lookupUpdateURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)
print(r)

0 Karma

chasrini
New Member

I was able to download inputlookup using JAVA SDK. Still some of the inputlookup I am not able to download, since they are kept in an APP in a different server where I am not connecting to.

The server where APP is present is not REST API enabled.
The server where REST API is enabled, they dont have that APP here.

The Application team dont want to move the inputlookup file from the APP where REST API is not enabled.

so If you know any way we can move the lookup csv file from one server to other server where REST API is enabled, either through splunk query or through an alert or any ways, will be helpful.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...