Splunk Dev

How to combine two rest services?

pkolhatk
Explorer

Hi wonderful people.

I wanted to know if we can combine two services in splunk to get an output 

| rest /services/authentication/users splunk_server=local 
and   

| rest /services/admin/SAML-groups splunk_server=local 

 how can I combine the above two to get the results in one query 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to create a single rest command that performs both actions.  You can, however, use the append command to combine the results of both commands then use stats to group them.

| rest splunk_server=local /services/admin/SAML-groups
| fields title roles 
| rename title as group
| append [ | rest splunk_server=local /services/admin/SAML-user-role-map
  | fields title roles 
  | rename title as user ]
| stats values(*) as * by roles
---
If this reply helps you, Karma would be appreciated.

ahhloy
New Member

Hi everyone, I tried combining two REST command by using append. However it does not work.

The first rest command , I would need to get info on who is the Search Head captain, and the 2nd rest command I would need to get the bundle replication file size from the search head captain to display the bundle size. Hope some one can assist. Thank you. 

 

| rest splunk_server=local /services/shcluster/captain/info
| fields Captain
| rename label as Captain
| append [ rest splunk_server=Captain /services/search/distributed/bundle-replication-files ]
| eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S")
| eval size=size/1024/1024/1024
| table filename timestamp size

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Another thing - if you want to find which server is captain to dynamically decide to which server you should send the next rest call, you can't just say splunk_server=Captain. That would be looking for a server called Captain which you most probably don't have.

You need to use one of the two possible techniques here - map command or subsearch.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@ahhloy - The append command does not combine the results, it generates two different results and append. To combine it you need to use the stats command after append. See the last line in the answer from @richgalloway 

0 Karma

ahhloy
New Member

@VatsalJagani thank you for the advise.. Not sure if the use of stats command is correct.

I would need the append output to show the search head captain, bundle size and file name. 

| rest /services/shcluster/status splunk_server=local
| fields captain.label
| append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files
| fields captain.label size filename
| eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S")
| eval size=size/1024/1024/1024
| table filename timestamp size ]
| rest /services/shcluster/status splunk_server=local
| fields captain.label
| append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files
| fields captain.label size filename
| eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S")
| eval size=size/1024/1024/1024
| table filename timestamp size ]
| stats latest(_time) as latest_time by captain.label size filename | convert ctime(latest_time)

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...