Getting Data In

How to index results from cURL?

morethanyell
Builder

Hi,

I'm at a dead end. I'm just playing around and wanting to index the JSON result of a cURL command. What do I do?

Is it possible to get the result of this cURL and have it indexed in Splunk?

Here's my working cURL.

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One approach is to write the results of the curl commands to a file and have Splunk monitor that file. Or you could use the oneshot command to index the results file.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

gjanders
SplunkTrust
SplunkTrust

You could set this up as a scripted input as per the docs page "Setting up a scripted input", this would result in the output of the command getting indexed.

Alternatively there will likely be a SplunkBase app for this, for example the Curl Command app or the Web Tools Add-on

richgalloway
SplunkTrust
SplunkTrust

One approach is to write the results of the curl commands to a file and have Splunk monitor that file. Or you could use the oneshot command to index the results file.

---
If this reply helps you, Karma would be appreciated.

morethanyell
Builder

I used Curl Command from splunkbase and used | collect to index the result

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...