Splunk Search

REST lookup functionality

Glenn
Builder

Is there any functionality (built-in to Splunk, or that someone has created custom) to do lookups to an external RESTful service from within a Splunk search, which functions similarly to a static file lookup or DB lookup with the DB connect app? This mean the rest query run from Splunk would return a table of some kind, which could be used for doing a lookup.

Our organisation maintains a Service Oriented Architecture, where we prefer to expose data via API rather than query DBs directly. Using a service layer allows us to manage performance indexing and caching, and avoids issues caused by db structural change etc.

A search command which can query a REST endpoint and lookup on the table which is returned would be a very useful piece of functionality.

The REST modular input is not quite right, as it indexes data from REST rather than doing lookups on it.

Tags (2)

starcher
SplunkTrust
SplunkTrust
0 Karma

starcher
SplunkTrust
SplunkTrust

Ah I had misunderstood the direction of data flow. I imagine your option is a scripted lookup. As long as you can make a python script that returns the results you need you could tie it to a lookup.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up...

http://www.georgestarcher.com/splunk-a-dns-lookup-for-abuse-contacts/

Glenn
Builder

OK thanks for the info, but I don't think this is relevant. My question is about how to access external REST interfaces from within Splunk, not about accessing the REST interface to Splunk itself. I'll tweak my question slightly to make it more clear.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...