Hello,
I'm quite new to splunk and I'm stuck somewhere...
My goal:
Sending data from a Splunk view (a webpage I created from the splunk web interface), process some fields in a custom REST endpoint and store them in the KV store.
What I have:
I already have the custom endpoint working, I can handle in py python script flat javascript value received but not enclosed objects.
Javascript (attached to a basic html form created in splunk interface):
...
data['name'] = aJsStringValue; // I can handle this in pyhton
data['list'][0] = aJsObject; // I failed
var service = mvc.createService();
service.post('/services/test', data, function(err, response) {
...
}
...
Python:
...
class test(splunk.rest.BaseRestHandler):
def handle_POST(self):
try:
...
name = ''
list = []
# parse the payload
payload = self.request['payload']
for el in payload.split('&'):
key, value = el.split('=')
if 'name' in key:
name = value
if 'list' in key:
# idk
...
Note: I can change all the structure if needed.
Thanks.
I couldn't find the ready solution for that, so created my own method - you need to extract both payload and content-type to pass it in:
def parsePayload(contentType, payload):
posted_parts = {}
if re.match('application/x-www-form-urlencoded', contentType):
posted_parts = urlparse.parse_qs(payload)
elif re.search('form-data', contentType):
# First, determine the separator (boundary)
parsedBoundary = re.search('boundary\s*=\s*(?P<boundary>\S+)', contentType)
boundary = parsedBoundary.group('boundary')
# Now, split the payload
# posted_parts = urlparse.parse_qs(payload)
parts = payload.split('--' + boundary)
for part in parts:
try:
parsedPart = re.search('Content-Disposition: form-data; name="(?P<name>[^"]+)"(\r?\nContent-Type:[^\r\n]*)?(\r?\nContent-Length:[^\r\n]*)?\r?\n\r?\n(?P<content>.*)', part)
posted_parts[parsedPart.group('name')] = parsedPart.group('content').strip()
# posted_parts.append({ 'name' : parsedPart.group('name'), 'value' : parsedPart.group('content') })
except:
pass
return posted_parts
If the code is completely working, please mark your answer as accepted so the question will be shown as answered. Thanks for posting the solution!