Getting Data In

Splunk Adaptive Response sending post command in REST API

ramesh_babu71
Path Finder

Hi,

I am trying to create a new app which will be used to send a Splunk Adaptive response via REST API. I am able get the response from Splunk REST API using using below code

     headers_server, content_server = rest.simpleRequest('/services/server/info?output_mode=json', sessionKey=sessionKey)

However my requirement is to convert the below curl command which has a POST action to python REST API.

curl -k -u admin:Password1 https://localhost:8089/services/data/inputs/script/restart?output_mode=json -d script=".\bin\script_test\windows.bat"

Would require you help on how to send this POST command in python REST API format.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @ramesh_babu71,

Please try this python code

   rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

EDIT1: Updated code, but what you want to achieve. It seems like /services/data/inputs/script/restartgiving me HTTP 400 error with GET request but didn't tried POST request.

EDIT2: Based on this doc http://docs.splunk.com/Documentation/Splunk/6.6.4/RESTREF/RESTinput#data.2Finputs.2Fscript.2Frestart
POST request should be like

rest.simpleRequest('/servicesNS/nobody/<APPNAME>/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi @ramesh_babu71,

Please try this python code

   rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

EDIT1: Updated code, but what you want to achieve. It seems like /services/data/inputs/script/restartgiving me HTTP 400 error with GET request but didn't tried POST request.

EDIT2: Based on this doc http://docs.splunk.com/Documentation/Splunk/6.6.4/RESTREF/RESTinput#data.2Finputs.2Fscript.2Frestart
POST request should be like

rest.simpleRequest('/servicesNS/nobody/<APPNAME>/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)
0 Karma

ramesh_babu71
Path Finder

Thanks Harshil. This is what I was looking for. The POST command lets me to restart/enable the scripted input

However a slight modification was required as \b in ".\bin...."python is taken as ASCII so we have to tell python to take it as string using r in front

 rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': r".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)
0 Karma

harsmarvania57
Ultra Champion

Great that it helped you, I have converted my comment to answer so you can accept it and thanks for the explanation about ASCII character.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...