Splunk Search

splunk URL query

Contributor

Is there a method for Splunk to generate a search if another application passes Splunk a URL? For this example, let’s assume I already have a user logged into Splunk to bypass the authentication requirement. Another application will generate a URL directed at the Splunk server with a search string for hostname and IP address.

So, another application will pass a URL that reads (for example) http://--/splunk?host=abc and Splunk will in turn generate a query.

If there are alternative solutions to achieve this, let me know.

TIA

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

It is possible, yes. In your scenario, you would pass the search "* | head 10" to flashtimeline using the url param q.

http://splunk_server/app/search/flashtimeline?q=search%20*%20|%20head%2010

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

It is possible, yes. In your scenario, you would pass the search "* | head 10" to flashtimeline using the url param q.

http://splunk_server/app/search/flashtimeline?q=search%20*%20|%20head%2010

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

That is if you intend to pass it through the client's browser which already has an authenticated session. You can authenticate through url parameters too by enabling insecure login. If you want to do this all programagically without use of client's browser, you'll want to leverage the REST API.

0 Karma