Splunk automation

[sansmish]

Hello everyone,

I want to automate Splunk.IF I make a dashboard manually and then I want to export it as an xml file.

After that if I make any changes in that xml file and commit the changes ,the changes should get reflected in Splunk dashboard.I don't know how to go about it .any suggestions and ideas are highly appreciated.

Thanks

[gjanders · Accepted solution]

In the version control for splunk app https://splunkbase.splunk.com/app/4355/
Or transfersplunkknowledgeobjects https://github.com/gjanders/Splunk

I have code that retrieves and posts back dashboards and other objects. Perhaps the transfer scripts might give you an idea...

[ITWhisperer]

Getting hold of the SimpleXML is simple enough - you can use the ReST API to retrieve the dashboard definition (See Tom West's video on YouTube https://www.youtube.com/watch?v=B9PuOPfdxd0&t=2858s around the 45minute mark). Getting a modified version back into splunk might be a little bit more tricky.

[richgalloway]

I think that falls into the same category as converting an HTML dashboard back into Simple XML - it's a Hard Problem that no one has solved, yet.  Your solution would have to read seemingly random XML and somehow figure out some sequence of Simple XML statements that would produce similar output.  That sounds like PhD work to me.  Export a dashboard then compare the Simple XML to the XML and you'll see what I mean.