Can we get data from API in Splunk App on demand and without indexing it?

[wazuhtest]

Hi,
Would it be possible to get data from an external RESTful API and draw the JSON results with Splunk element as charts or tables?
Thank you in advance

[starcher · Accepted solution]

Yes you can make a custom search command to fetch and enhance your search data as fields.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Aboutcustomsearchcommands

[wazuhtest]

I appreciate so much your quick response .
After reading those documents it's not quite clear for me how to enhance the JSON results as data fields in order to draw charts or tables with them even if I make a command for fetching the data with 'wget' or 'curl'. Please, could you give me more details about it?
Thank you for your help

[starcher]

You need to have some development skills. Preferably python. You want a streaming command to add fields to events. This is an example of adding/modifying fields on events as they pass through the command. The code to get such data from an api is additional you'd have to do.
https://github.com/georgestarcher/TA-esreplacefields/blob/master/bin/esreplacefields.py

[wazuhtest]

Thank you so much, I will check it

[wazuhtest]

Hi again @starcher, I've been checking out your scripts and I think there are some conceptual issues I'm still not getting. How could I retrieve those fetched jsons from the script to the Splunk app? And how could I draw, for example, a table with them if they're not indexed?
Lets say that I want to fetch data from - https://externfoo.bar/logs?page=1 when I press page 1 in the table, https://externfoo.bar/logs?page=2 when page 2 is pressed, and so. All in real time and on demand.
Thank you again for your help