RStudio integration with Splunk

[mgianola]

Is there any way to run Splunk queries from the RStudio IDE rather than from within the search bar?

[aljohnson_splun · Accepted solution]

The Splunk® SDKs are written on top of the Splunk REST APIs. The intent is to give you broad coverage of the REST API in a language-specific fashion to ease your access to the Splunk engine.

Currently, Splunk has SDKs for these languages:

• Python
• Java
• JavaScript
• PHP
• Ruby
• C#

As you will note, R is not on this list.

---

however,

All of these are just wrappers around the REST api. You can query the the REST api directly using the RCurl and xml libraries.
In RStudio:

install.packages('RCurl')
install.packages('XML')

Once you've got both of those, you can go ahead and look at the REST api documentation.

To be honest, this is all really ugly with the xml responses and I don't think you want to do it...

library(RCurl)
library(xml)
opts = curlOptions(userpwd="admin:changeme", ssl.verifypeer=FALSE, username="admin", password="changeme")
response <- getURL("https://localhost:8089/servicesNS/admin/search/saved/searches/test", .opts = opts)
parsed <- xmlParse(response)

You get the idea. It's not pretty.

tl;dr

can you? yes. should you? no. use one of the sdks.

look at this python-ease

import splunklib.client as client

HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"

# Create a Service instance and log in 
service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

# Print installed apps to the console to verify login
for app in service.apps:
    print app.name