Shulou(Shulou.com)06/01 Report--

This article mainly shows you "Splunk how to import data through rest http", the content is easy to understand, clear, hope to help you solve doubts, the following let the editor lead you to study and learn "Splunk how to import data through rest http" this article.

New tag

To send data through the http API, http event collector, you need to create a new tag in splunk first.

Set-> data entry-> HTTP event Collector-> New tag

Enter a name

Select index

Get the marked value

test

Curl-k https://IP:8088/services/collector/event-H "Authorization: Splunk 9213be6a-2ebc-47bb-9da9-e9c2fa1345f4"-d "{\" host\ ":\" 127.0.0.1\ ",\" time\ ": 1561144452.611000,\" sourcetype\ ":\" some_sourcetype\ ",\" index\ ":\" sample\ ",\" event\ ": {\" eventKey\ ":\" 0\ ",\" uuid\ ":\" 88b5e9fd-ebe0-4fe1-aeeb-b3d583ec9cfd\ " \ "message\":\ "dnnpfbbwic\"} {\ "time\": 1561144552.611000,\ "sourcetype\":\ "some_sourcetype\",\ "index\":\ "sample\",\ "event\": {\ "eventKey\":\ "0\",\ "uuid\":\ "88b5e9fd-ebe0-4fe1-aeeb-b3d583ec9cfd\",\ "message\":\ "abc\"}

When it is sent successfully, it will be displayed.

{

"text": "Success"

"code": 0

}

Encapsulation based on Python3

# coding=utf-8

Import urllib

Import httplib2

From xml.dom import minidom

Import time

Import json

Import traceback

Class SplunkInput (object):

Def _ init__ (self):

Self.baseurl = 'https://IP:8088'

Self.sessionKey = 'tag value'

Def submit_job (self, data):

Result_response = httplib2.Http (disable_ssl_certificate_validation=True)\

.request (self.baseurl +'/ services/collector/event'

'POST'

Headers= {'Authorization':' Splunk% s'% self.sessionKey}

Body=json.dumps (data)) [1]

Return result_response

Def run (self, data):

Start = time.time ()

Result = self.submit_job (data)

End = time.time ()

Print ("submit time:" end-start)

Return result

Call

Print ("> SplunkInput > >")

Hostname = socket.gethostname ()

SI = SplunkInput ()

S_time = int (time.time ())

Data = [{

"host": hostname

"sourcetype": "test"

"index": "sample"

"event": {

"eventKey": "0"

"uuid": "88b5e9fd-ebe0-4fe1-aeeb-b3d583ec9cfd"

"message": "abc"

}

}, {

"host": hostname

"time": s_time

"sourcetype": "test"

"index": "sample"

"event": {

"eventKey": "1"

"uuid": "1233444-ebe0-4fe1-aeeb-b3d583ec9cfd"

"message": "def"

}

}]

The above is all the contents of the article "how Splunk imports data through rest http". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.