Splunk Dev

How to handle posted data in custom endpoint?

nori_t
New Member

Hello,

I'm quite new to splunk and I'm stuck somewhere...

  • My goal:
    Sending data from a Splunk view (a webpage I created from the splunk web interface), process some fields in a custom REST endpoint and store them in the KV store.

  • What I have:
    I already have the custom endpoint working, I can handle in py python script flat javascript value received but not enclosed objects.

Javascript (attached to a basic html form created in splunk interface):

    ...
    data['name'] = aJsStringValue; // I can handle this in pyhton
    data['list'][0] = aJsObject; // I failed

    var service = mvc.createService(); 
    service.post('/services/test', data, function(err, response) { 
    ...
    }
    ...

Python:

    ...
    class test(splunk.rest.BaseRestHandler):
        def handle_POST(self):
            try:
                ...
                name = ''
                list = []

                # parse the payload
                payload = self.request['payload']
                for el in payload.split('&'):
                     key, value = el.split('=')
                     if 'name' in key:
                        name = value
                     if 'list' in key:
                        # idk
                ...
  • My problem: I want to send a list of dictionaries inside my javascript object but I don't know how to handle it in python. I wanted to use Json and put a String directly as "params" value for the "service.post()" but it is obviously interpreted as an array. I could do a workaround, use "JSON.stringify(data);" and place the string in a simple field "data" but I would like to know if a better way exists?

Note: I can change all the structure if needed.

Thanks.

0 Karma

arkadyz1
Builder

I couldn't find the ready solution for that, so created my own method - you need to extract both payload and content-type to pass it in:

def parsePayload(contentType, payload):
    posted_parts = {}
    if re.match('application/x-www-form-urlencoded', contentType):
        posted_parts = urlparse.parse_qs(payload)
    elif re.search('form-data', contentType):
        # First, determine the separator (boundary)
        parsedBoundary = re.search('boundary\s*=\s*(?P<boundary>\S+)', contentType)
        boundary = parsedBoundary.group('boundary')
        # Now, split the payload
        # posted_parts = urlparse.parse_qs(payload)
        parts = payload.split('--' + boundary)
        for part in parts:
            try:
                parsedPart = re.search('Content-Disposition: form-data; name="(?P<name>[^"]+)"(\r?\nContent-Type:[^\r\n]*)?(\r?\nContent-Length:[^\r\n]*)?\r?\n\r?\n(?P<content>.*)', part)
                posted_parts[parsedPart.group('name')] = parsedPart.group('content').strip()
                # posted_parts.append({ 'name' : parsedPart.group('name'), 'value' : parsedPart.group('content') })
            except:
                pass
    return posted_parts
0 Karma

DalJeanis
Legend

If the code is completely working, please mark your answer as accepted so the question will be shown as answered. Thanks for posting the solution!

0 Karma
Get Updates on the Splunk Community!

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...