Splunk Dev

python or python sdk example for adding data via services/receivers/simple rest

monzy
Communicator

is there an example in the python sdk examples that i can follow to post data to a splunk index via the services/receivers/simple REST endpoint ? if not via python sdk, perhaps something using urllib2 or some other python standard library. i am currently using the python postprocess module with curl as described here. but there is probably a more elegant, sustainable, os independent, way to post data.

0 Karma

monzy
Communicator

thanks Damien. the little preamble to this is that one needs to instantiate a client.connect object (service in the example). i followed this example for the connection setup. between your help and that, this was really painless. thank you.


import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)
    
# Send an event over HTTP
# Retrieve the index for the data
myindex = service.indexes["obix"]
# Submit an event over HTTP
myindex.submit("This is my HTTP event", sourcetype="access_combined.log", host="local")

Damien_Dallimor
Ultra Champion

Example code here : http://dev.splunk.com/view/python-sdk/SP-CAAAEE6#add2index

# Send an event over HTTP

# Retrieve the index for the data
myindex = service.indexes["test_index"]

# Submit an event over HTTP
myindex.submit("This is my HTTP event", sourcetype="access_combined.log", host="local")

The method you want to use (submit) is at line 1823 : https://github.com/splunk/splunk-sdk-python/blob/master/splunklib/client.py

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...