Getting Data In

Help with Injesting Oracle Fusion Application Audit logs

zubairsp
Explorer

Hello follow Splunkers!

We want to ingest Oracle Fusion Application (SaaS) audit logs into Splunk on-prem, and the only way to do this is through the REST API GET method. So, now that I cannot find a REST input option in Splunk or any free add-on from Splunk for this task, all I have read over the internet is to develop a script. I need your support to share a sample Python script that should not only pull the logs but also avoid duplicate logs with every pull.

Thanks in advance!

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You have three options here.

1. Create a completely external script that will pull data from your REST endpoint and write it to a file for ingestion by file monitor input or send it to a HEC input. That's probably the easiest (in the quick and dirty sense) but least maintainable one.

2. Create a modular input manually - https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtocreatemo...

3. Use add-on builder to create modular input - https://docs.splunk.com/Documentation/AddonBuilder/4.2.0/UserGuide/ConfigureDataCollection

View solution in original post

0 Karma

zubairsp
Explorer

@PickleRick I appreciate your reply. The add-on builder option is what I'll go with. But will the add-on option work with XML data, given the data type is XML and the Splunk documentation only discusses JSON format? If so, do I need to apply the same "JSON path formats"? If not, can you kindly provide the formats or a reference guide?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/AddonBuilder/4.2.0/UserGuide/ConfigureDataCollection#Add_a_dat...

Build the data collection for your add-on to gather data from a REST API. A REST data input uses JSON as a data type and supports basic authentication and API-based authentication. For advanced data collection, create a modular input by writing your own Python code.

So if your source returns XML.. well, you're on your own here.

0 Karma

zubairsp
Explorer

Made some changes at source, now we are getting the logs in JSON format and Add-on builder option worked fine.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You have three options here.

1. Create a completely external script that will pull data from your REST endpoint and write it to a file for ingestion by file monitor input or send it to a HEC input. That's probably the easiest (in the quick and dirty sense) but least maintainable one.

2. Create a modular input manually - https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtocreatemo...

3. Use add-on builder to create modular input - https://docs.splunk.com/Documentation/AddonBuilder/4.2.0/UserGuide/ConfigureDataCollection

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...