What is the feasibility of using Splunk REST calls from an Angular application running HTLM5 to send data into Splunk directly from the browser?

[jamesoconnell]

We have a partner who wants an extremely light interface to send data into a Splunk instance.
They prefer to make a simple REST call directly from the browser to load a JSON payload into Splunk.
The goal is to NOT have a heavy server-side process, but rather a lightweight REST interface directly to Splunk.

The data would be keyed on the user working in the browser at the time of the call out.
The data would be accessed in a Splunk dashboard/report keying on the user and his/her data.

I saw a recommendation from another post regarding HTTP Event Collector for this purpose. On first thought this seems feasible, but I am interested in knowing the pluses and minuses of both solutions.

Regards.

[murbanek_splunk · Accepted solution]

This is an interesting use case. This does certainly look like an ideal use case for the http event collector on the heavy forwarder, here are a few reasons why:

• The heavy forwarder with http event collector is built for this sort of demand
• Lightweight is relative, a solution needs to be available and resilient and scalable.
• Depending on how your network topology is segmented, you'll want a heavy forwarder with an http event collector (not an indexer) as close to the edge as possible: http://dev.splunk.com/view/event-collector/SP-CAAAE73 . see Scenario 2 & 3. You didn't mention if this was for internet facing http calls, but I'm assuming they are.
• Reusability, should similar use cases arise in the future, you now have a solution that can be shared with other application needs.

Cheers

[jamesoconnell]

Thanks for the quick response Michael.

I'll work with our partner to get them started on using our existing HTTP Event Collectors.
cheers,
-Jim O.