Can we create a form in Splunk to add events?

[bud9]

I have the following job run details getting indexed:

JobName  JobStartTime    JobEndTime      JobStatus
APM1234, 01/11/19 09:00, 01/11/19 09:30, COMPLETE
APM1235, 01/11/19 09:05, 01/11/19 09:35, FAILED
APM1236, 01/11/19 09:10, 01/11/19 09:40, RUNNING
APM1237, 01/11/19 09:15, 01/11/19 09:45, RUNNING

I wanted to create a form for the user that shows up FAILED jobs in last 24 hours and they should be able to add an event when a job was force completed. Eg. Suppose if the user marks the job APM1235 as force completed, the following event should be added:

JobName  JobStartTime    JobEndTime      JobStatus
APM1235, 01/11/19 09:05, 01/11/19 09:35, FORCE-COMPLETED

This is possible in Splunk? Any help is appreciated. Thank you so much!

[martin_mueller]

Yes, there are many ways to build this in Splunk.

One would be to have your form run a tiny bit of JavaScript that runs a search like this: | makeresults | sendalert logevent param.event="Hello World!" [obviously with more stuff configured for the sendalert command...].

Another would be to have your form run a tiny bit of JavaScript that calls this REST endpoint: https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTinput#receivers.2Fsimple

And yet another would be to have your form run a tiny bit of JavaScript that sends events to a HEC receiver: https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/UsetheHTTPEventCollector

I'm sure there are more options.

[sdchakraborty]

May be you can create a custom command which will do the indexing using "data/inputs/oneshot
" endpoint. When user make the job force-completed from UI you can call the custom command.

Please refer the below link for end point details.

https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTinput

Sid