Getting Data In

How do you process Websocket data in Splunk?


I have a program logging out responses from a websocket endpoint to a file. I want to be able to get this data into Splunk and analyze it in the following way.

There are multiple updates to each unique response (depicted by "versions") on this websocket. For example, if I made 50 requests — the websocket would send me back a response per each request and keep updating it every x seconds until the websocket is closed.

I want to be able to:

  1. Count how many responses I've received (as the index is being populated)
  2. Make sure the response updates (denoted by versions) are being updated every x seconds, if they're not I don't want to count them

I have a response ID to uniquely specify each response in the logs and I have also have the version number and timestamp in the logs.

I want to know if this would be possible or is a good idea to do over Splunk — the main reason I thought of Splunk is because this involves real-time data, and because I want to be able to make a nice dashboard out of it.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...