Hi,
Would it be possible to get data from an external RESTful API and draw the JSON results with Splunk element as charts or tables?
Thank you in advance
Yes you can make a custom search command to fetch and enhance your search data as fields.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Aboutcustomsearchcommands
Yes you can make a custom search command to fetch and enhance your search data as fields.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Aboutcustomsearchcommands
I appreciate so much your quick response .
After reading those documents it's not quite clear for me how to enhance the JSON results as data fields in order to draw charts or tables with them even if I make a command for fetching the data with 'wget' or 'curl'. Please, could you give me more details about it?
Thank you for your help
You need to have some development skills. Preferably python. You want a streaming command to add fields to events. This is an example of adding/modifying fields on events as they pass through the command. The code to get such data from an api is additional you'd have to do.
https://github.com/georgestarcher/TA-esreplacefields/blob/master/bin/esreplacefields.py
Thank you so much, I will check it
Hi again @starcher, I've been checking out your scripts and I think there are some conceptual issues I'm still not getting. How could I retrieve those fetched jsons from the script to the Splunk app? And how could I draw, for example, a table with them if they're not indexed?
Lets say that I want to fetch data from - https://externfoo.bar/logs?page=1 when I press page 1 in the table, https://externfoo.bar/logs?page=2 when page 2 is pressed, and so. All in real time and on demand.
Thank you again for your help