Can splunk Index data from an HTTP address

[htkhtk]

I have a url that has a server.txt file on that that gets updated as the requests/responses are coming through.

Can splunk index that http://website.com/server.txt address?

If so, how? Thanks!

[pabstec]

Check out the "rest" command.

[nicholasgrabows]

There is a new splunkbase app called "importutil". It lets you import input from an http url via the splunk search command line. Also works for ftp. sftp is experimental.

http://splunk-base.splunk.com/apps/69078/importutil

Here is an ftp example. Pulling from the bureau of labor stats:

|importutil ftp ftp://ftp.bls.gov/pub/time.series/ce/ce.data.102.WeeklyEarningsHist
| multikv
| table series_id, year, period, value, footnote_codes

Here is an http example that imports data from the federal reserve economic data website:

|importutil http http://research.stlouisfed.org/fred2/data/PAYEMS.csv
| multikv
| table DATE, VALUE

[sfurness]

Is Web Page Monitor still available? For some reason I can't find it in the Apps section?

[gkanapathy]

Yes, I was looking for it, and it used to do just what was requested, when it was around.

[ziegfried · Accepted solution]

Sure, just set up a scripted input, that fetches the url.

Dokumentation: http://www.splunk.com/base/Documentation/4.1.5/Admin/Setupcustom(scripted)inputs

As an example, you could use the curl command on Linux/Unix:

#!/bin/bash
curl http://website.com/server.txt

[gkanapathy]

There is also http://www.splunkbase.com/apps/All/app:Web+Page+Monitor