All Apps and Add-ons

What's the best way to import custom JSON data from a web API?

em
Engager

I'd like to pull in JSON data like the one that is available from dev dot moves-app dot com slash activities. (It's from an API from an iOS app called Moves which tracks people's movements.)

I can think of lots of strategies, but I'd rather not reinvent the wheel. One issue (which could be a separate question), is how to get the data from the API into Splunk. My guess for that would be to build on top of the REST API Modular Input Splunk app, or write it myself.

My main question is to how to best handle the data once it comes in. The JSON that the API serves is quite different from traditional log data.

Thanks in advance!

0 Karma

Damien_Dallimor
Ultra Champion

The REST API Modular Input has the ability to plugin custom response handlers to facilitate any custom handling or pre-processing of the raw JSON response before passing along to Splunk for indexing.

Have a look in rest_ta/bin/responsehandlers.py at the example TwitterEventHandler.

You then declare your custom response handler to be applied in your setup stanza for the REST input.

Damien_Dallimor
Ultra Champion

you can certainly import and call another python module from responsehandlers.py

0 Karma

crawlik
New Member

Is there a way to have my custom event handler in a separate .py file? I would like to avoid putting it in intoresponsehandlers.py. Please advise if there is any downside for doing it.

0 Karma

aelliott
Motivator
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...