Web form to create events using splunk webserver?

[phoenixdigital]

We are trying to create a web form (filled in by humans) to create events to be digested by Splunk.

Now there are a few ways to do this

1. Install webserver (apache or iis) and have a php (or .net) script which will process the form and send to splunk via (syslog, tcp or write to monitored file/directory)
2. Install webserver and have javascript send results via tcp directly to splunk.

Now I am wondering if instead is using a webserver would it be possible to piggy back these forms in the splunk web at all?

Thoughts?

[MHibbin]

Yes, I would take this as definately being possible...

You would first need to create your form to handle the right amount of inputs, where you can use typical form features (text input, dropdown lists (you use a lookup file (via inputlookup command) or search results for this)... Don't worry about the search for now. (Documentation here)

Then you will need to create a script (something in python would be ideal), this should be created to handle sys.argv[] inputs, which will basically be the user's input. You could then have this data formatted to your needs via your script. Have this script write to a file somewhere on the Splunk installation. Once you have set up your script, you will then need to add this to a custom command via the "commmands.conf" file. (Documentation here)

Now, back to the form, you will need a search for the form using your custom command. I typically use a search starting with |inputlookup OR |metadata as these usually have little search overhead. Then pipe to your custom command. You will then assign the user inputs to the custom command as arguments. For example:

|inputlookup foo | someCommand $arg1$ $arg2$ $arg3$ $arg4$ $arg5$ etc

Then once you have the form writing to the file, have Splunk monitor this file for updates.

May not be the best way but I have had some weird requests that this has helped with.

Cheers,

MHibbin

P.S there are probably better methods, but I think this is the easiest to set-up... and why install a web server? Splunk comes packaged with cherryPy as it's webservice.

P.P.S. If you set up some output to stdout, you can use the event viewer for a form to show the user some information, like "You are not a real person, try again".