Splunk Search

REST lookup functionality

Builder

Is there any functionality (built-in to Splunk, or that someone has created custom) to do lookups to an external RESTful service from within a Splunk search, which functions similarly to a static file lookup or DB lookup with the DB connect app? This mean the rest query run from Splunk would return a table of some kind, which could be used for doing a lookup.

Our organisation maintains a Service Oriented Architecture, where we prefer to expose data via API rather than query DBs directly. Using a service layer allows us to manage performance indexing and caching, and avoids issues caused by db structural change etc.

A search command which can query a REST endpoint and lookup on the table which is returned would be a very useful piece of functionality.

The REST modular input is not quite right, as it indexes data from REST rather than doing lookups on it.

Tags (2)

SplunkTrust
SplunkTrust
0 Karma

SplunkTrust
SplunkTrust

Ah I had misunderstood the direction of data flow. I imagine your option is a scripted lookup. As long as you can make a python script that returns the results you need you could tie it to a lookup.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up...

http://www.georgestarcher.com/splunk-a-dns-lookup-for-abuse-contacts/

Builder

OK thanks for the info, but I don't think this is relevant. My question is about how to access external REST interfaces from within Splunk, not about accessing the REST interface to Splunk itself. I'll tweak my question slightly to make it more clear.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!