Splunk Search

Generate lookup files via webservices

nebel
Communicator

Hi there,

I want to avoid to copy via scp files on my cloudsearch for using them in lookups.
Is it possible to create lookup files by using API or some other webservices?

Thanks in advance

Tags (1)
0 Karma
1 Solution

Marinus
Communicator

You have two options as I see it.

You either have to fetch the data for lookup from outside of Splunk using something like SCP + some parsting or call a python program to look the data up in real time.

You need to consider the performance impact. You could always implement some kind of caching strategy with your python program if the data is rather static.

Here's an example props and transform

[mylookup]
LOOKUP-bucket_lookup=lookup_buckets narrative account OUTPUT bucket

[lookup_buckets] 
external_type = python external_cmd = bucket_lookup.py fields_list = narrative,account,bucket

If you are planning to call a SOAP web service from Python I'd suggest you use SUDS.

View solution in original post

0 Karma

Marinus
Communicator

You have two options as I see it.

You either have to fetch the data for lookup from outside of Splunk using something like SCP + some parsting or call a python program to look the data up in real time.

You need to consider the performance impact. You could always implement some kind of caching strategy with your python program if the data is rather static.

Here's an example props and transform

[mylookup]
LOOKUP-bucket_lookup=lookup_buckets narrative account OUTPUT bucket

[lookup_buckets] 
external_type = python external_cmd = bucket_lookup.py fields_list = narrative,account,bucket

If you are planning to call a SOAP web service from Python I'd suggest you use SUDS.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...