Splunk Dev

Is it possible to create, retrieve, modify, and delete eventtypes from Javascript SDK?

sashankdvk
New Member

Can we create/retrieve/update/delete eventtypes, tags from javascript SDK ?
If yes how do we it?

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Eventtypes and tags can be trivially made using the REST API - SDK not required. All you need is something that can make HTTP calls, like the JQuery $.ajax() function, or whatever you would use in NodeJS. The SDK exposes parts of the entities available via the REST API as subclasses of splunkjs.Service - like splunkjs.Service.SavedSearches. There is no pre-built splunkjs.Service.EventTypes, so you'd have to extend the SDK some.

But if you look here, you can see the underlying REST API for making a new EventType: http://docs.splunk.com/Documentation/Splunk/6.4.3/RESTREF/RESTknowledge#saved.2Feventtypes Here is an example of using that endpoint, via curl on the command line, to make a new eventtype and tag it.

curl -k -u admin:changeme 'https://localhost:8089/servicesNS/admin/search/saved/eventtypes?output_mode=json' -X POST -d 'name=example' -d 'search=index=abc sourcetype=foo' -d 'tags=potato,tomato,crap'

Again anything that can create an HTTP request with post data can do this. The SDK's wrappings make it somewhat easier, but you don't strictly need it.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Yes and no. Eventtypes and tags can be trivially made using the REST API - SDK not required. All you need is something that can make HTTP calls, like the JQuery $.ajax() function, or whatever you would use in NodeJS. The SDK exposes parts of the entities available via the REST API as subclasses of splunkjs.Service - like splunkjs.Service.SavedSearches. There is no pre-built splunkjs.Service.EventTypes, so you'd have to extend the SDK some.

But if you look here, you can see the underlying REST API for making a new EventType: http://docs.splunk.com/Documentation/Splunk/6.4.3/RESTREF/RESTknowledge#saved.2Feventtypes Here is an example of using that endpoint, via curl on the command line, to make a new eventtype and tag it.

curl -k -u admin:changeme 'https://localhost:8089/servicesNS/admin/search/saved/eventtypes?output_mode=json' -X POST -d 'name=example' -d 'search=index=abc sourcetype=foo' -d 'tags=potato,tomato,crap'

Again anything that can create an HTTP request with post data can do this. The SDK's wrappings make it somewhat easier, but you don't strictly need it.

0 Karma

sashankdvk
New Member

thanks for the answer it is helpful. We are trying to make this similar call from JS , can you tell us how to authenticate to splunk server using JS than in curl ? will the splunk service give us some authentication token ?

0 Karma

nimeshkakadiya
Explorer

@sashankdvk were you able to solve this problem? I am trying to do exactly same. I would really appreciate if you can share how you solve this.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...