Getting Data In

How do I upload a file to a custom REST API endpoint?



I am try to upload a file to a custom REST API endpoint, but I am not having much luck (I'm using Splunk 7.0.4). I have the following custom REST API handler which currently just echos back the request to the client browser (it is configured correctly and is being invoked):

import splunk

class FileUpload(

    def handle_POST(self):
        except Exception as e:
            self.response.write("ERROR: " + str(e))

And I have some JavaScript which uses jQuery to perform an AJAX POST containing a selected file (I am testing using recent versions of Chrome and Firefox):

function uploadButtonCallback(e) {

    var fileInput = document.getElementById('appfile_id');
    var file= fileInput.files[0];

    var callback= function(response) {
    sendRequest('POST', URL, file, callback);

function sendRequest(type, url, file, callback) {
    var formData = new FormData();
    formData.append('file', file)

      'type': type,
      'url' : url,
      'data': formData,
      'processData': false,
      'contentType': false
    .success((response) => console.log(response))
    .error((response) => console.log(response))

But I am not seeing the file content echoed back - this is what I get printed in the JS console:

18:41:44.517 Response: -----------------------------214284223518627931251367576440
Content-Disposition: form-data; name="file"; filename=file.pkg"
Content-Type: application/

I have been able to get this to work by using the JavaScript FileReader.readAsDataURL() function and sending the file as a base64 encoded String, however this does not work for large files (Chrome and Firefox both crash/fail).

I believe the client-side JavaScript is correct - it seems like something is stripping the binary data from the request before the Python handler is invoked. Can anyone help?


PS if there is another way to have a file uploaded to a known location on the Splunk host (without it being indexed) - I would love to hear about it.


I am also interested in this.

0 Karma


Also facing this issue.

Can't access except in payload, which would require substantial effort to parse back into a readable file, complete with filename, extension etc.

Has to be a better way.

0 Karma


Hi @fanatic ,

We currently have exactly the same problem.

We wish we could upload a file using splunk js but it looks like the header "Content-Type": "multipart/form-data" is never set using the built-in method from spunk such as and service.request(...). as a result, the file cannot be sent with that header and the only solution we found out is to send file content using JSON body.

As an alternative, we can use JQuery native methods and it sends properly the file... but the URI is not correct and it doesn't contain the expected cookies while methods such as service.request(...) and add all the necessary headers and cookies.

How did you solve your requirement ?

Thank you

0 Karma

Revered Legend
0 Karma


Thanks for the reply - that post seems to deal with saving a file which is generated by Splunk, the problem I'm having is uploading a file via a web browser

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...