Splunk Search

Creating a REST endpoint to allow csv lookup files to be uploaded/updated?

Aaron_Fogarty
Path Finder

I would like to create a REST endpoint that will allow me to to automate the uploading and updating of a csv lookup file daily.
Is it possible to create such an endpoint and what would be the process to achieve this?

There is a similar question to this, but it has no accepted answer.

https://answers.splunk.com/answers/369789/how-to-create-or-update-kv-store-via-rest-endpoint.html

Thank you in advance.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I'm guessing you updated the URI form .../servicesNS/admin/search/.... to .../servicesNS/-/search/.. to create it in search app. For the other error, could you check if the Splunk user (user under which Splunk service is running has appropriate permissions on the lookup table file you're trying to upload?

0 Karma

Aaron_Fogarty
Path Finder

Hey Somesoni2,

I posted an answer below, It wont let me post it here for some reason.

0 Karma

Aaron_Fogarty
Path Finder

Yeah somesoni2 thats exactly what I did, Ill post for others to see

Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 
Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv

As for the 'Data could not be written:' error, I am running the command line as the Administrator. I also chaged the TestLookup.csv file properties>>security permissions of all the Group and user names to allow full control. Is this what you meant?

I then restarted Splunk and re-ran the following command. I still got the 'Data could not be written' error

curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv
0 Karma

Aaron_Fogarty
Path Finder

Yeah thats exactly what I did somesoni2, Ill post for others to see.

Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x 

Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x https://http.proxy.fmr.com:8000

As for the 'Data could not be written' error. I am running the command line as the Administrator. I opened the TestLookup.csv file properties>>security and changed the permissions of all Group and user names to allow full control.

I then restarted Splunk and re-ran the following command, but I still got the same 'Data could not be written' error.

curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x https://http.proxy.fmr.com:8000
0 Karma

Aaron_Fogarty
Path Finder

Yeah thats exactly what I did somesoni2, Ill post for others to see.

Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 

Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 

For the 'Data could not be written' error. I am running as admin user.

Under Properties>>Security I changed the permissions to all group and user names to full control for the TestLookup.csv file.

I restarted Splunk and re-ran the following command but I still got the same error

curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 
0 Karma

Aaron_Fogarty
Path Finder

Hey somesoni2,

I will try this out and get back.

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...