Pulling data into splunk via API

[dolj]

What is the best practice to have a Splunk heavy forwarder call out to a third party API and pull logs into Splunk. Most of the solutions I use have apps on Splunk base but this one does not. Do I have to build a custom add-on using something like the add-on builder? 

[livehybrid]

Further to my last message - this is a great blog post on getting started with UCC so well worth checking out

https://www.splunk.com/en_us/blog/customers/managing-splunk-add-ons-with-ucc-framework.html

Let us know how you get on and if you have any further questions 🙂

Will

[livehybrid]

Hi @dolj 

If there isnt already a Splunkbase app for the API you want to work with then you may be best using the Splunk Universal Configuration Console (UCC) framework to build yourself a custom app. This has had much more development recently than Add-on builder and is easier to manage moving forwards.

Here is a sample app which might give some insight on how it works, this is taken from a Conf talk I did on creating a simple API app in 2023. https://github.com/livehybrid/conf23-dev1091b/

Also have a look at the UCC docs (https://splunk.github.io/addonfactory-ucc-generator/) for more information and to get started.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will