Splunk Enterprise

How to send curl request from Splunk dashboard?

mottig
Path Finder

Hi,

I am  a new to spunk.

I am trying to send an REST request from splunk dashboard by a submit button to external server that listens http requests.

How can i achieve that goal? I basically need to send a simple curl with a var in the path that will be selected by the user from a drop down list.

 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

That is exactly what you can do with the add on. 

Effectively the button can set a token and then the SPL containing the curl command can execute and notify your backend server to perform whatever you need it to.

In Splunk everything is a search, so you will just have a hidden search that is dependent on the token that can be set by the button. Clicking the button will set the token, causing the SPL to run.

See the Custom Token Links example in the Splunk Dashboard Examples app, which shows you how to do buttons/tokens.

Then your SPL would be something like this, where the curl_button_token token is set by the button and cleared again when the search has run.

<search depends="$curl_button_token$">
  <query>
| curl ...
  </query>
  <done>
    <unset token="curl_button_token"></unset>
  </done>
</search>

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Take a look at this addon

https://splunkbase.splunk.com/app/4146/

 

0 Karma

mottig
Path Finder

Thank you for your answer.

Im not sure this addon is what I need.

This addon is allowing to have curl sending abilities in SPL. I need to send an API from a button in a dashboard

that is not related to to the data.

For example I want to notify my backend server to start send me events from a certain type(that will be define as a strings in another drop down list).

0 Karma

bowesmana
SplunkTrust
SplunkTrust

That is exactly what you can do with the add on. 

Effectively the button can set a token and then the SPL containing the curl command can execute and notify your backend server to perform whatever you need it to.

In Splunk everything is a search, so you will just have a hidden search that is dependent on the token that can be set by the button. Clicking the button will set the token, causing the SPL to run.

See the Custom Token Links example in the Splunk Dashboard Examples app, which shows you how to do buttons/tokens.

Then your SPL would be something like this, where the curl_button_token token is set by the button and cleared again when the search has run.

<search depends="$curl_button_token$">
  <query>
| curl ...
  </query>
  <done>
    <unset token="curl_button_token"></unset>
  </done>
</search>

 

chaker
Contributor

Without fully understanding what you are trying to achieve, you can try using the solution below to run the SPL command that @bowesmana suggested add-on offers, or perhaps this may give you other ideas to solve the problem.

https://community.splunk.com/t5/Dashboards-Visualizations/Button-to-run-splunk-query/m-p/454739/high...

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...