Getting Data In

How to connect to a cloud based application to pull logs into Splunk via REST API?

sbattista09
Contributor

What would the steps be to connect to a cloud based application to pull logs via API into Splunk? I am trying to learn how to use this function of Splunk and not sure where to start and the documentation is a little hard to follow. Keep in mind I am not a programmer.

larryleeroberts
Path Finder

It seems really strange to me that Splunk has yet to offer a method to "pull". Recently, Dynatrace made the Dynatrace SaaS logs available through their API. I want to pull these into Splunk. I agree with Rich that it looks like the only way to do this is through the API and writing something on your own to execute the pull.

0 Karma

adnankhan5133
Communicator

Is there a specific method to pull Oracle Cloud Platform logs into Splunk? Would this require using REST API's or the HTTP Event Collector?

woodcock
Esteemed Legend

You would not use REST API for that, you would use Http Event Collector (HEC):
http://dev.splunk.com/view/event-collector/SP-CAAAE6M

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The OP said he wanted to "pull" logs into Splunk, which I take to mean "do something on the Splunk server to get my cloud logs indexed". That's why I suggested the REST app.
The HEC would be the way to go if the cloud app was pushing logs into Splunk and could be modified to use HEC.

---
If this reply helps you, Karma would be appreciated.
0 Karma

woodcock
Esteemed Legend

There is no clientless way to pull anything anywhere so I assumed he mis-spoke and that he needs a clientless push.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have a look at the REST API Modular Input app (https://splunkbase.splunk.com/app/1546/#/documentation ). It will do most of the heavy lifting for you, but you may need to do some programming yourself (or get some help).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...