How to update blacklist lookup table from local server to remote splunk server programmaically? Rest api?

[sgsharmila]

Hi ,

   I wanted to update blacklist lookup table for the list of server . I wanted to download the existing blacklist lookup table . In the downloaded  csv file i wanted to check the  list of host name that i wanted to blacklist. If the host name already present in lookup table edit the field blacklist_alert column to 0 then upload the lookup table 

I wanted to achieve this using python scripting .

Do we have any rest api or any other way to do this programmatically?

[sloshburch]

Just off the top of my head, I think this can be done more easily using Splunk and not a python script.

You would have a splunk search that runs and makes a list of the servers. You can append to that search the existing list of servers from the CSV. Do whatever manipulation you wanted as part of the search and then output the results back into the lookup file.

They key commands for this are:

• inputlookup
• outputlookup
• lookup

[sgsharmila]

Hi,

 I am trying to automate the blacklist table update automatically. Where if Change request is created for the list of servers .Those  list of servers  we need to suppress the alert. Already  internal client team developed script depends on the blacklist lookup table that will suppress the event. so my task is remotely update the lookup table by script. we won't login to splunk GUI.

[sloshburch]

Oh interesting. To be honest, it's a bit hard to follow the setup so my apologies if I misunderstand.

For what it's worth, you could use a search, scheduled to run on a recurring basis, to update the list automatically. But it sounds like you've got things set up already so I only share this info in case you ever want to do the whole thing within Splunk and not use scripts.

To answer your question about updating the lookup files from an external script, I would check out Splunk's rich set of REST API endpoints in the Splunk® Enterprise REST API Reference Manual. To that end, it looks like the Knowledge Endpoints have some options that are promising for your needs. For example, I think the data/lookup-table-files/{name} endpoint. See https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#data.2Flookup-table-files.... for specifics.

Good luck!