Dashboards & Visualizations

Can we create a form in Splunk to add events?

bud9
New Member

I have the following job run details getting indexed:

JobName  JobStartTime    JobEndTime      JobStatus
APM1234, 01/11/19 09:00, 01/11/19 09:30, COMPLETE
APM1235, 01/11/19 09:05, 01/11/19 09:35, FAILED
APM1236, 01/11/19 09:10, 01/11/19 09:40, RUNNING
APM1237, 01/11/19 09:15, 01/11/19 09:45, RUNNING

I wanted to create a form for the user that shows up FAILED jobs in last 24 hours and they should be able to add an event when a job was force completed. Eg. Suppose if the user marks the job APM1235 as force completed, the following event should be added:

JobName  JobStartTime    JobEndTime      JobStatus
APM1235, 01/11/19 09:05, 01/11/19 09:35, FORCE-COMPLETED

This is possible in Splunk? Any help is appreciated. Thank you so much!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes, there are many ways to build this in Splunk.

One would be to have your form run a tiny bit of JavaScript that runs a search like this: | makeresults | sendalert logevent param.event="Hello World!" [obviously with more stuff configured for the sendalert command...].

Another would be to have your form run a tiny bit of JavaScript that calls this REST endpoint: https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTinput#receivers.2Fsimple

And yet another would be to have your form run a tiny bit of JavaScript that sends events to a HEC receiver: https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/UsetheHTTPEventCollector

I'm sure there are more options.

sdchakraborty
Contributor

May be you can create a custom command which will do the indexing using "data/inputs/oneshot
" endpoint. When user make the job force-completed from UI you can call the custom command.

Please refer the below link for end point details.

https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTinput

Sid

0 Karma
Get Updates on the Splunk Community!

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...