I would like to create a REST endpoint that will allow me to to automate the uploading and updating of a csv lookup file daily.
Is it possible to create such an endpoint and what would be the process to achieve this?
There is a similar question to this, but it has no accepted answer.
https://answers.splunk.com/answers/369789/how-to-create-or-update-kv-store-via-rest-endpoint.html
Thank you in advance.
I'm guessing you updated the URI form .../servicesNS/admin/search/....
to .../servicesNS/-/search/..
to create it in search app. For the other error, could you check if the Splunk user (user under which Splunk service is running has appropriate permissions on the lookup table file you're trying to upload?
Hey Somesoni2,
I posted an answer below, It wont let me post it here for some reason.
Yeah somesoni2 thats exactly what I did, Ill post for others to see
Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv
Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv
As for the 'Data could not be written:' error, I am running the command line as the Administrator. I also chaged the TestLookup.csv file properties>>security permissions of all the Group and user names to allow full control. Is this what you meant?
I then restarted Splunk and re-ran the following command. I still got the 'Data could not be written' error
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv
Yeah thats exactly what I did somesoni2, Ill post for others to see.
Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x
Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x https://http.proxy.fmr.com:8000
As for the 'Data could not be written' error. I am running the command line as the Administrator. I opened the TestLookup.csv file properties>>security and changed the permissions of all Group and user names to allow full control.
I then restarted Splunk and re-ran the following command, but I still got the same 'Data could not be written' error.
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x https://http.proxy.fmr.com:8000
Yeah thats exactly what I did somesoni2, Ill post for others to see.
Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv
Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv
For the 'Data could not be written' error. I am running as admin user.
Under Properties>>Security I changed the permissions to all group and user names to full control for the TestLookup.csv file.
I restarted Splunk and re-ran the following command but I still got the same error
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv
Hey somesoni2,
I will try this out and get back.
Thanks