Splunk Dev

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

chasrini
New Member

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

Labels (3)
0 Karma
1 Solution

starcher
Influencer

Simplest solution is execute an inputlookup command and parse the search results

View solution in original post

0 Karma

starcher
Influencer

Simplest solution is execute an inputlookup command and parse the search results

0 Karma

chasrini
New Member

Thanks for the update. They have kept the lookup csv file in a custom app. Its not on the "Search & Reporting" app. so I am not able to fetch the CSV result from that app. I tried using python like below but it returned resp code 200 and not the data present in CSV file. Is there any function or method thru which I can get the CSV file info.

import json
import csv
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

splunkApp = "splunk_xxx"
splunkUser = "xx"
splunkPwd = "xx"
splunkURI = "https://splunkxx.trusted.xxx.com:port/en-US/manager/splunk_xx/data/lookup-table-files"
lookupName = "xx.csv"
lookupUpdateURI = "%s/%s" % (splunkURI, lookupName)

headers = {'Content-Type': 'application/json'}
data = {"eai:data" : "/opt/splunk/sh/splunk/etc/apps/splunk_xx/lookups/xx.csv"}
r = requests.get(lookupUpdateURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)
print(r)

0 Karma

chasrini
New Member

I was able to download inputlookup using JAVA SDK. Still some of the inputlookup I am not able to download, since they are kept in an APP in a different server where I am not connecting to.

The server where APP is present is not REST API enabled.
The server where REST API is enabled, they dont have that APP here.

The Application team dont want to move the inputlookup file from the APP where REST API is not enabled.

so If you know any way we can move the lookup csv file from one server to other server where REST API is enabled, either through splunk query or through an alert or any ways, will be helpful.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...