How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

[chasrini]

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

[starcher · Accepted solution]

Simplest solution is execute an inputlookup command and parse the search results

[chasrini]

Thanks for the update. They have kept the lookup csv file in a custom app. Its not on the "Search & Reporting" app. so I am not able to fetch the CSV result from that app. I tried using python like below but it returned resp code 200 and not the data present in CSV file. Is there any function or method thru which I can get the CSV file info.

import json
import csv
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

splunkApp = "splunk_xxx"
splunkUser = "xx"
splunkPwd = "xx"
splunkURI = "https://splunkxx.trusted.xxx.com:port/en-US/manager/splunk_xx/data/lookup-table-files"
lookupName = "xx.csv"
lookupUpdateURI = "%s/%s" % (splunkURI, lookupName)

headers = {'Content-Type': 'application/json'}
data = {"eai:data" : "/opt/splunk/sh/splunk/etc/apps/splunk_xx/lookups/xx.csv"}
r = requests.get(lookupUpdateURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)
print(r)

[chasrini]

I was able to download inputlookup using JAVA SDK. Still some of the inputlookup I am not able to download, since they are kept in an APP in a different server where I am not connecting to.

The server where APP is present is not REST API enabled.
The server where REST API is enabled, they dont have that APP here.

The Application team dont want to move the inputlookup file from the APP where REST API is not enabled.

so If you know any way we can move the lookup csv file from one server to other server where REST API is enabled, either through splunk query or through an alert or any ways, will be helpful.