How to load this external data in a dashboard without saving it in Splunk?

[fedejko]

Hello,

I have a dashboard which is using one token - as a result two things happen:

• a search is conducted on an index with some static data
• I want to load data from external source (.txt file available online) which changes every hour

This is the source: 

https://tgftp.nws.noaa.gov/data/observations/metar/stations/KJFK.TXT

Desired state: The dashboard takes airport's ICAO code and displays static information about this airport from the index and also loads external current weather information (which changes very frequently).

How to load this external data in a dashboard without saving it in Splunk?

I would like to state, that I have no option to ingest this data into an index every hour, or create a lookup file locally - this data will change all the time so ideally I would like to fetch it online every time.

Many thanks in advance!

[gcusello]

Hi @fedejko,

if you want to load a csv on file system, you could try the inputcsv comman (https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Inputcsv).

If instead you want an upload window, this feature isn't available, you have to load it using a php or Python program.

Maybe the best approach should be to have an input that reads files from a folder where you put the files, but this means index it in Splunk.

Ciao.

Giuseppe

[fedejko]

Hi,

Thanks for your reply, but I cannot store it in csv or in an index. I want to load this one line of text from online source every time.

[gcusello]

Hi @fedejko,

if you want to add only one line at a time, you could use a text input in a dashboard to add the line.

Ciao.

Giuseppe

[fedejko]

You don't understand. I want the dashboard to display this line automatically, not to paste it myself - that would be pointless. If you want to help me - please read the description of my issue again.

[gcusello]

Hi @fedejko,

sorry for the misunderstanding!

let me summarize:

• you have a text file on filesystem,
• in each text file there's only one raw,
• you want to load this raw in a dashboard without indexing it,
• you want to use this raw in a search;

is it correct?

Anyway, why do you want to not index the information from this file?

reading this file every time it is updated and indexing it, you have all you need.

In Splunk only the contents in indexes or in lookups are searchable, you don't want to put these information neither in indexes or in lookups so it isn't possible.

At least you have only two solutions:

• index this file: it's the easiest best performant and more efficiant solution;
• copy the file in a lookup with a ascipt and read it as a lookup.

Ciao.

Giuseppe

[fedejko]

Hey,

"let me summarize:

you have a text file on filesystem,"

No, I have weather data available online which I want to "pull" to my dashboard. It has a URL like this: https://tgftp.nws.noaa.gov/data/observations/metar/stations/<XXXX>.TXT

And for each dashboard load I will put the search term in a field and I want to load a specific content from a URL. If I specify "KJFK" the url loaded will be

https://tgftp.nws.noaa.gov/data/observations/metar/stations/KJFK.TXT (for John F. Kennedy airport)

If I specify CYYZ, the url will be

https://tgftp.nws.noaa.gov/data/observations/metar/stations/CYYZ.TXT (weather for Toronto airport).

[gcusello]

Hi @fedejko,

it isn't possible to pull a data to a dashboard,

in a dashboard you can read a data from an index, a lookup or a csv or a manual input text box, not pulling data from outsoude of these input modes.

Ciao.

Giuseppe