Getting Data In

Need help with custom response handler for REST API Modular input

zubairsp
Explorer

We have below data in json format, i need help with a custom json response handler so splunk can break every event separately.  Each event starts with the record_id

{
"eventData": [
{
"record_id": "19643",
"eventID": "1179923",
"loginID": "PLI",
"userDN": "cn=564SD21FS8DF32A1D87FAD1F,cn=Users,dc=us,dc=oracle,dc=com",
"type": "CredentialValidation",
"ipAddress": "w.w.w.w",
"status": "success",
"accessTime": "2024-08-29T06:23:03.487Z",
"oooppd": "5648sd1csd-952f-d630a41c87ed-000a3e2d",
"attributekey": "User-Agent",
"attributevalue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
},
{
"record_id": "19644",
"eventID": "1179924",
"loginID": "OKP",
"userDN": "cn=54S6DF45S212XCV6S8DF7,cn=Users,dc=us,dc=CVGH,dc=com",
"type": "Logout",
"ipAddress": "X.X.X.X",
"status": "success",
"accessTime": "2024-08-29T06:24:05.040Z",
"oooppd": "54678S3D2FS962SDFV3246S8DF",
"attributekey": "User-Agent",
"attributevalue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
}
]
}

Labels (1)
0 Karma

zubairsp
Explorer

I found below response handler, will this work or does it require any modification? as per the sample in my original request.

class ArrayHandler:

def __init__(self,**args):
pass

def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint,oauth2=None):
if response_type == "json":
raw_json = json.loads(raw_response_output)
column_list = []
for column in raw_json['columns']:
column_list.append(column['name'])
for row in raw_json['rows']:
i = 0;
new_event = {}
for row_item in row:
new_event[column_list[i]] = row_item
i = i+1
print(print_xml_stream(json.dumps(new_event)))

else:
print_xml_stream(raw_response_output)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...