Splunk Search

Splunk Data Export

scout29
Path Finder

We have a lookup in Splunk that we are looking to send a few columns in the lookup to another product via a POST API call. My question is, are there any Splunk add-ons that i can leverage to do this? I see there is an HTTP alert action that can make a POST, however with this being a lookup (csv) i am not sure it will work correctly. 

Labels (1)
0 Karma

marnall
Motivator

That should be doable. Does the other product have documentation describing the format in which it expects to receive the lookup? You should be able then to use SPL to convert the lookup into that format, in one or more fields, then send it using the POST HTTP alert action.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

there are at least this one https://splunkbase.splunk.com/app/5927. Not exactly what you are looking for, but probably it gives you some ideas how to do it.

Basically you can do it as you said alert action (could be an issue, if you want sent lot of data?). Another way is to create a custom command and use it. But If. you have lot of data to export, then maybe easiest way to go is just create saved search, call it with splunk rest api with some other job management software/system which then send it forward.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...