Splunk Dev

How to handle posted data in custom endpoint?

nori_t
New Member

Hello,

I'm quite new to splunk and I'm stuck somewhere...

  • My goal:
    Sending data from a Splunk view (a webpage I created from the splunk web interface), process some fields in a custom REST endpoint and store them in the KV store.

  • What I have:
    I already have the custom endpoint working, I can handle in py python script flat javascript value received but not enclosed objects.

Javascript (attached to a basic html form created in splunk interface):

    ...
    data['name'] = aJsStringValue; // I can handle this in pyhton
    data['list'][0] = aJsObject; // I failed

    var service = mvc.createService(); 
    service.post('/services/test', data, function(err, response) { 
    ...
    }
    ...

Python:

    ...
    class test(splunk.rest.BaseRestHandler):
        def handle_POST(self):
            try:
                ...
                name = ''
                list = []

                # parse the payload
                payload = self.request['payload']
                for el in payload.split('&'):
                     key, value = el.split('=')
                     if 'name' in key:
                        name = value
                     if 'list' in key:
                        # idk
                ...
  • My problem: I want to send a list of dictionaries inside my javascript object but I don't know how to handle it in python. I wanted to use Json and put a String directly as "params" value for the "service.post()" but it is obviously interpreted as an array. I could do a workaround, use "JSON.stringify(data);" and place the string in a simple field "data" but I would like to know if a better way exists?

Note: I can change all the structure if needed.

Thanks.

0 Karma

arkadyz1
Builder

I couldn't find the ready solution for that, so created my own method - you need to extract both payload and content-type to pass it in:

def parsePayload(contentType, payload):
    posted_parts = {}
    if re.match('application/x-www-form-urlencoded', contentType):
        posted_parts = urlparse.parse_qs(payload)
    elif re.search('form-data', contentType):
        # First, determine the separator (boundary)
        parsedBoundary = re.search('boundary\s*=\s*(?P<boundary>\S+)', contentType)
        boundary = parsedBoundary.group('boundary')
        # Now, split the payload
        # posted_parts = urlparse.parse_qs(payload)
        parts = payload.split('--' + boundary)
        for part in parts:
            try:
                parsedPart = re.search('Content-Disposition: form-data; name="(?P<name>[^"]+)"(\r?\nContent-Type:[^\r\n]*)?(\r?\nContent-Length:[^\r\n]*)?\r?\n\r?\n(?P<content>.*)', part)
                posted_parts[parsedPart.group('name')] = parsedPart.group('content').strip()
                # posted_parts.append({ 'name' : parsedPart.group('name'), 'value' : parsedPart.group('content') })
            except:
                pass
    return posted_parts
0 Karma

DalJeanis
Legend

If the code is completely working, please mark your answer as accepted so the question will be shown as answered. Thanks for posting the solution!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...