Splunk Dev

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

chasrini
New Member

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

Labels (3)
0 Karma
1 Solution

starcher
Influencer

Simplest solution is execute an inputlookup command and parse the search results

View solution in original post

0 Karma

starcher
Influencer

Simplest solution is execute an inputlookup command and parse the search results

0 Karma

chasrini
New Member

Thanks for the update. They have kept the lookup csv file in a custom app. Its not on the "Search & Reporting" app. so I am not able to fetch the CSV result from that app. I tried using python like below but it returned resp code 200 and not the data present in CSV file. Is there any function or method thru which I can get the CSV file info.

import json
import csv
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

splunkApp = "splunk_xxx"
splunkUser = "xx"
splunkPwd = "xx"
splunkURI = "https://splunkxx.trusted.xxx.com:port/en-US/manager/splunk_xx/data/lookup-table-files"
lookupName = "xx.csv"
lookupUpdateURI = "%s/%s" % (splunkURI, lookupName)

headers = {'Content-Type': 'application/json'}
data = {"eai:data" : "/opt/splunk/sh/splunk/etc/apps/splunk_xx/lookups/xx.csv"}
r = requests.get(lookupUpdateURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)
print(r)

0 Karma

chasrini
New Member

I was able to download inputlookup using JAVA SDK. Still some of the inputlookup I am not able to download, since they are kept in an APP in a different server where I am not connecting to.

The server where APP is present is not REST API enabled.
The server where REST API is enabled, they dont have that APP here.

The Application team dont want to move the inputlookup file from the APP where REST API is not enabled.

so If you know any way we can move the lookup csv file from one server to other server where REST API is enabled, either through splunk query or through an alert or any ways, will be helpful.

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...