Splunk Search

Splunk Data Export

scout29
Path Finder

We have a lookup in Splunk that we are looking to send a few columns in the lookup to another product via a POST API call. My question is, are there any Splunk add-ons that i can leverage to do this? I see there is an HTTP alert action that can make a POST, however with this being a lookup (csv) i am not sure it will work correctly. 

Labels (1)
0 Karma

marnall
Motivator

That should be doable. Does the other product have documentation describing the format in which it expects to receive the lookup? You should be able then to use SPL to convert the lookup into that format, in one or more fields, then send it using the POST HTTP alert action.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

there are at least this one https://splunkbase.splunk.com/app/5927. Not exactly what you are looking for, but probably it gives you some ideas how to do it.

Basically you can do it as you said alert action (could be an issue, if you want sent lot of data?). Another way is to create a custom command and use it. But If. you have lot of data to export, then maybe easiest way to go is just create saved search, call it with splunk rest api with some other job management software/system which then send it forward.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...