Splunk Dev

python or python sdk example for adding data via services/receivers/simple rest

monzy
Communicator

is there an example in the python sdk examples that i can follow to post data to a splunk index via the services/receivers/simple REST endpoint ? if not via python sdk, perhaps something using urllib2 or some other python standard library. i am currently using the python postprocess module with curl as described here. but there is probably a more elegant, sustainable, os independent, way to post data.

0 Karma

monzy
Communicator

thanks Damien. the little preamble to this is that one needs to instantiate a client.connect object (service in the example). i followed this example for the connection setup. between your help and that, this was really painless. thank you.


import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)
    
# Send an event over HTTP
# Retrieve the index for the data
myindex = service.indexes["obix"]
# Submit an event over HTTP
myindex.submit("This is my HTTP event", sourcetype="access_combined.log", host="local")

Damien_Dallimor
Ultra Champion

Example code here : http://dev.splunk.com/view/python-sdk/SP-CAAAEE6#add2index

# Send an event over HTTP

# Retrieve the index for the data
myindex = service.indexes["test_index"]

# Submit an event over HTTP
myindex.submit("This is my HTTP event", sourcetype="access_combined.log", host="local")

The method you want to use (submit) is at line 1823 : https://github.com/splunk/splunk-sdk-python/blob/master/splunklib/client.py

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...