Injest JSON document returned from an monitoring endpoint

[givanov]

Hello,

I'm having a service which exports monitoring data through a JSON endpoint. Is it possible to have Splunk call that endpoint and injest the returned JSON document?

Thank you,
- George

[nicholasgrabows]

You could also try this a new splunkbase app called "importutil". It lets you import input from an http, ftp, or sftp url via the splunk search command line. sftp is experimental.

http://splunk-base.splunk.com/apps/69078/importutil

Here is an http example that imports data from the federal reserve economic data website:

|importutil http http://research.stlouisfed.org/fred2/data/PAYEMS.csv
| multikv
| table DATE, VALUE

Set this up as a scheduled search. So it will hit the URL periodically.

[dwaddle]

Yes, use a scripted input. Splunk calls your script on an interval and your script makes the call to you service and emits the results on stdout which Splunk then indexes.