Splunk Dev

How to handle posted data in custom endpoint?

nori_t
New Member

Hello,

I'm quite new to splunk and I'm stuck somewhere...

  • My goal:
    Sending data from a Splunk view (a webpage I created from the splunk web interface), process some fields in a custom REST endpoint and store them in the KV store.

  • What I have:
    I already have the custom endpoint working, I can handle in py python script flat javascript value received but not enclosed objects.

Javascript (attached to a basic html form created in splunk interface):

    ...
    data['name'] = aJsStringValue; // I can handle this in pyhton
    data['list'][0] = aJsObject; // I failed

    var service = mvc.createService(); 
    service.post('/services/test', data, function(err, response) { 
    ...
    }
    ...

Python:

    ...
    class test(splunk.rest.BaseRestHandler):
        def handle_POST(self):
            try:
                ...
                name = ''
                list = []

                # parse the payload
                payload = self.request['payload']
                for el in payload.split('&'):
                     key, value = el.split('=')
                     if 'name' in key:
                        name = value
                     if 'list' in key:
                        # idk
                ...
  • My problem: I want to send a list of dictionaries inside my javascript object but I don't know how to handle it in python. I wanted to use Json and put a String directly as "params" value for the "service.post()" but it is obviously interpreted as an array. I could do a workaround, use "JSON.stringify(data);" and place the string in a simple field "data" but I would like to know if a better way exists?

Note: I can change all the structure if needed.

Thanks.

0 Karma

arkadyz1
Builder

I couldn't find the ready solution for that, so created my own method - you need to extract both payload and content-type to pass it in:

def parsePayload(contentType, payload):
    posted_parts = {}
    if re.match('application/x-www-form-urlencoded', contentType):
        posted_parts = urlparse.parse_qs(payload)
    elif re.search('form-data', contentType):
        # First, determine the separator (boundary)
        parsedBoundary = re.search('boundary\s*=\s*(?P<boundary>\S+)', contentType)
        boundary = parsedBoundary.group('boundary')
        # Now, split the payload
        # posted_parts = urlparse.parse_qs(payload)
        parts = payload.split('--' + boundary)
        for part in parts:
            try:
                parsedPart = re.search('Content-Disposition: form-data; name="(?P<name>[^"]+)"(\r?\nContent-Type:[^\r\n]*)?(\r?\nContent-Length:[^\r\n]*)?\r?\n\r?\n(?P<content>.*)', part)
                posted_parts[parsedPart.group('name')] = parsedPart.group('content').strip()
                # posted_parts.append({ 'name' : parsedPart.group('name'), 'value' : parsedPart.group('content') })
            except:
                pass
    return posted_parts
0 Karma

DalJeanis
Legend

If the code is completely working, please mark your answer as accepted so the question will be shown as answered. Thanks for posting the solution!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...