Data source for my requirement is coming from HTTP request. I can fetch the data in command line using CURL command and seeking help on how to import that same in Splunk. The response expected is in json format.
I am going through the reference - http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Spath but it doesnt specify on how to import the data. Any help on how to feed splunk with CURL data would be great.
For example, my request in command line is like - curl "http://finance.google.com/finance/info?client=ig&q=NASDAQ%3aGOOG"
and the response - // [ { "id": "694653" ,"t" : "GOOG" ,"e" : "NASDAQ" ,"l" : "873.32" ,"l_cur" : "873.32" ,"s": "0" ,"ltt":"4:00PM EDT" ,"lt" : "May 24, 4:00PM EDT" ,"c" : "-9.47" ,"cp" : "-1.07" ,"ccol" : "chr" } ]
Guys, any help ?
Thanks for your reply. I am going down the path of scripted input as importutil doesnt support cURL.
I have couple of questions
{"text": {
"data": "Click here",
"size": 36,
"data": "Learn more",
"size": 37,
"data": "Help",
"size": 38,
}
os_version : "10.9,
updated_at : "2013-05-27T04:24:57Z",
user_string : ""
}
Please help me construct an spath search for json response.
importutil should do just what you want.
If you want to setup a more permanent input, you should set up a scripted input that uses for instance curl to get the data and then echoes it back into Splunk.