Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Pass JSON or XML as parameters to custom Pytho...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey guys,
How to
Pass JSON or XML as parameters to custom Python script via Splunk REST API ?
Example:
I use REST API like this
curl -ku MyUser:MyPwd https://MyServer:8089/services/search/jobs/export?output_mode=json -d search=' | MyScript param1 param2 '
What if I want these parameters
param1 ="JonSnow"
param1 ="[{\"name\":\"Ned\",\"house\":\"Stark\"}]
Version 6.5.2 or 7+ of Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey guys,
Solved long time ago. This is standart: passing smth like JSON thru REST API is just passing a string parameter for a custom Python script (when calling via REST API a search like " | myScript arg1=\"aaa\" arg2=\"bbb\" "
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey guys,
Solved long time ago. This is standart: passing smth like JSON thru REST API is just passing a string parameter for a custom Python script (when calling via REST API a search like " | myScript arg1=\"aaa\" arg2=\"bbb\" "
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you provide more clarity on this? Are you trying to implement a custom REST endpoint?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I've updated the question. Please take a look.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Still doesn't make sense. Is you script hosted as a custom REST Endpoint ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's just a custom script on my server that runs several Splunk searches. I want to pass not only alphanumeric parameters, but a json package to my searches to be used in alerting rules.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
