I am working on an App that will allow users to select a file or folder and then call a python script in the background to run "splunk add oneshot <file(s)>" to index them.
I am looking for a UI option which will allow users to browse and select file/folder similar to what is available in Splunk -> Settings -> Add Data option
thanks in advance.
I don't see any specific reference to "input type=file" in the Simple XML documentation, which also doesn't seem to be what you're looking for anyway. (Using that would result in the contents of that file being uploaded when the form was submitted)
But there are a couple of issues that seem like they would cause problems with this approach.
Remember that Splunk is running on a server somewhere, while the browser is being run (generally speaking) from a client. The path information for locating a file will most likely be different between the two. For example, if I select a file on my local PC named
c:\log\app.log and pass that name to the server, the server isn't going to have any way of accessing that file.
So while I understand what you're trying to achieve, I have a lot of doubt about it being possible. (I've learned often enough not to go so far to say it's impossible - I've been proven wrong too many times before. But I'd be real interested to see if you get a viable solution to this.)
I think your best bet would be some type of client-side program that would send the data to Splunk through the API.
Thanks Ken for the response. My requirements are as such that the required files would be present in the splunk server itself through an NFS mount or a share. I have a python script ready to be called through a dummy search that would go through the list if files in a folder and then subsequently run 'splunk add oneshot' command.
All I need is an interface that would allow user to pick a folder that would be on the spunk server itself. I have looked at the UI examples and I am unable to find a way through simple XML. Looking at the Splunk -> Add data -> files and directors option itself, it seems like it is an App by itself ( data preview ) , not sure if we can somehow leverage this.