Getting Data In

Data type for cURL with JSON response

msn2507
Path Finder

Data source for my requirement is coming from HTTP request. I can fetch the data in command line using CURL command and seeking help on how to import that same in Splunk. The response expected is in json format.

I am going through the reference - http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath but it doesnt specify on how to import the data. Any help on how to feed splunk with CURL data would be great.

For example, my request in command line is like - curl "http://finance.google.com/finance/info?client=ig&q=NASDAQ%3aGOOG"

and the response - // [ { "id": "694653" ,"t" : "GOOG" ,"e" : "NASDAQ" ,"l" : "873.32" ,"l_cur" : "873.32" ,"s": "0" ,"ltt":"4:00PM EDT" ,"lt" : "May 24, 4:00PM EDT" ,"c" : "-9.47" ,"cp" : "-1.07" ,"ccol" : "chr" } ]

Tags (2)
0 Karma

msn2507
Path Finder

Guys, any help ?

0 Karma

msn2507
Path Finder

Thanks for your reply. I am going down the path of scripted input as importutil doesnt support cURL.

I have couple of questions

  1. I am following this reference to extract the fields but the search (sourcetype="count_size" | spath output=myfield path=text.size) doesnt yield anything for a response like this -

{"text": {
"data": "Click here",
"size": 36,
"data": "Learn more",
"size": 37,
"data": "Help",
"size": 38,
}
os_version : "10.9,
updated_at : "2013-05-27T04:24:57Z",
user_string : ""
}

Please help me construct an spath search for json response.

  1. How do I tell Splunk to capture only the delta data of the request instead of capturing the entire response for every fetch ?
0 Karma

Ayn
Legend

importutil should do just what you want.

If you want to setup a more permanent input, you should set up a scripted input that uses for instance curl to get the data and then echoes it back into Splunk.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...