Splunk Dev

How to handle posted data in custom endpoint?

nori_t
New Member

Hello,

I'm quite new to splunk and I'm stuck somewhere...

  • My goal:
    Sending data from a Splunk view (a webpage I created from the splunk web interface), process some fields in a custom REST endpoint and store them in the KV store.

  • What I have:
    I already have the custom endpoint working, I can handle in py python script flat javascript value received but not enclosed objects.

Javascript (attached to a basic html form created in splunk interface):

    ...
    data['name'] = aJsStringValue; // I can handle this in pyhton
    data['list'][0] = aJsObject; // I failed

    var service = mvc.createService(); 
    service.post('/services/test', data, function(err, response) { 
    ...
    }
    ...

Python:

    ...
    class test(splunk.rest.BaseRestHandler):
        def handle_POST(self):
            try:
                ...
                name = ''
                list = []

                # parse the payload
                payload = self.request['payload']
                for el in payload.split('&'):
                     key, value = el.split('=')
                     if 'name' in key:
                        name = value
                     if 'list' in key:
                        # idk
                ...
  • My problem: I want to send a list of dictionaries inside my javascript object but I don't know how to handle it in python. I wanted to use Json and put a String directly as "params" value for the "service.post()" but it is obviously interpreted as an array. I could do a workaround, use "JSON.stringify(data);" and place the string in a simple field "data" but I would like to know if a better way exists?

Note: I can change all the structure if needed.

Thanks.

0 Karma

arkadyz1
Builder

I couldn't find the ready solution for that, so created my own method - you need to extract both payload and content-type to pass it in:

def parsePayload(contentType, payload):
    posted_parts = {}
    if re.match('application/x-www-form-urlencoded', contentType):
        posted_parts = urlparse.parse_qs(payload)
    elif re.search('form-data', contentType):
        # First, determine the separator (boundary)
        parsedBoundary = re.search('boundary\s*=\s*(?P<boundary>\S+)', contentType)
        boundary = parsedBoundary.group('boundary')
        # Now, split the payload
        # posted_parts = urlparse.parse_qs(payload)
        parts = payload.split('--' + boundary)
        for part in parts:
            try:
                parsedPart = re.search('Content-Disposition: form-data; name="(?P<name>[^"]+)"(\r?\nContent-Type:[^\r\n]*)?(\r?\nContent-Length:[^\r\n]*)?\r?\n\r?\n(?P<content>.*)', part)
                posted_parts[parsedPart.group('name')] = parsedPart.group('content').strip()
                # posted_parts.append({ 'name' : parsedPart.group('name'), 'value' : parsedPart.group('content') })
            except:
                pass
    return posted_parts
0 Karma

DalJeanis
Legend

If the code is completely working, please mark your answer as accepted so the question will be shown as answered. Thanks for posting the solution!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...