Getting Data In

How to update blacklist lookup table from local server to remote splunk server programmaically? Rest api?

sgsharmila
Loves-to-Learn Lots

Hi ,

   I wanted to update blacklist lookup table for the list of server . I wanted to download the existing blacklist lookup table . In the downloaded  csv file i wanted to check the  list of host name that i wanted to blacklist. If the host name already present in lookup table edit the field blacklist_alert column to 0 then upload the lookup table 

 

I wanted to achieve this using python scripting .

Do we have any rest api or any other way to do this programmatically?

Labels (1)
Tags (1)
0 Karma

sloshburch
Splunk Employee
Splunk Employee

Just off the top of my head, I think this can be done more easily using Splunk and not a python script.

You would have a splunk search that runs and makes a list of the servers. You can append to that search the existing list of servers from the CSV. Do whatever manipulation you wanted as part of the search and then output the results back into the lookup file.

They key commands for this are:

0 Karma

sgsharmila
Loves-to-Learn Lots

Hi,

 I am trying to automate the blacklist table update automatically. Where if Change request is created for the list of servers .Those  list of servers  we need to suppress the alert. Already  internal client team developed script depends on the blacklist lookup table that will suppress the event. so my task is remotely update the lookup table by script. we won't login to splunk GUI.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Oh interesting. To be honest, it's a bit hard to follow the setup so my apologies if I misunderstand.

For what it's worth, you could use a search, scheduled to run on a recurring basis, to update the list automatically. But it sounds like you've got things set up already so I only share this info in case you ever want to do the whole thing within Splunk and not use scripts.

To answer your question about updating the lookup files from an external script, I would check out Splunk's rich set of REST API endpoints in the Splunk® Enterprise REST API Reference Manual. To that end, it looks like the Knowledge Endpoints have some options that are promising for your needs. For example, I think the data/lookup-table-files/{name} endpoint. See https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Flookup-table-files.... for specifics.

Good luck!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...