Splunk Dev

How to combine two rest services?

pkolhatk
Engager

Hi wonderful people.

I wanted to know if we can combine two services in splunk to get an output 

| rest /services/authentication/users splunk_server=local 
and   

| rest /services/admin/SAML-groups splunk_server=local 

 how can I combine the above two to get the results in one query 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to create a single rest command that performs both actions.  You can, however, use the append command to combine the results of both commands then use stats to group them.

| rest splunk_server=local /services/admin/SAML-groups
| fields title roles 
| rename title as group
| append [ | rest splunk_server=local /services/admin/SAML-user-role-map
  | fields title roles 
  | rename title as user ]
| stats values(*) as * by roles
---
If this reply helps you, Karma would be appreciated.

ahhloy
New Member

Hi everyone, I tried combining two REST command by using append. However it does not work.

The first rest command , I would need to get info on who is the Search Head captain, and the 2nd rest command I would need to get the bundle replication file size from the search head captain to display the bundle size. Hope some one can assist. Thank you. 

 

| rest splunk_server=local /services/shcluster/captain/info
| fields Captain
| rename label as Captain
| append [ rest splunk_server=Captain /services/search/distributed/bundle-replication-files ]
| eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S")
| eval size=size/1024/1024/1024
| table filename timestamp size

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Another thing - if you want to find which server is captain to dynamically decide to which server you should send the next rest call, you can't just say splunk_server=Captain. That would be looking for a server called Captain which you most probably don't have.

You need to use one of the two possible techniques here - map command or subsearch.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@ahhloy - The append command does not combine the results, it generates two different results and append. To combine it you need to use the stats command after append. See the last line in the answer from @richgalloway 

0 Karma

ahhloy
New Member

@VatsalJagani thank you for the advise.. Not sure if the use of stats command is correct.

I would need the append output to show the search head captain, bundle size and file name. 

| rest /services/shcluster/status splunk_server=local
| fields captain.label
| append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files
| fields captain.label size filename
| eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S")
| eval size=size/1024/1024/1024
| table filename timestamp size ]
| rest /services/shcluster/status splunk_server=local
| fields captain.label
| append [ | rest splunk_server=local /services/search/distributed/bundle-replication-files
| fields captain.label size filename
| eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S")
| eval size=size/1024/1024/1024
| table filename timestamp size ]
| stats latest(_time) as latest_time by captain.label size filename | convert ctime(latest_time)

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...