Getting Data In

curl in Shell Script run by splunk return empty

pdevosceazure
Path Finder

I am trying to get data from a third party API

so I get splunk to run this very basic script.

IP=$(curl -s 'http://api.openweathermap.org/data/2.5/weather?q=london,uk&appid=xxxxxxxxxxxxxxxxxxxxxxx')
echo "$IP"

if I run the script in shell it works perfect.
if it is run by splunk $ip is empty

I know splunk can execute the script because I replace $(curl.... by "test" and splunk collects it OK.

splunk seams to be executing script as root because if chance my script to
whoiam
splunk returns root.

it is not just this url i tried different ones, it works in shell but it is always empty when run by splunk.

koshyk
Super Champion

The best way to integrate with API is to use "REST modular Input" within splunk rather than calling a script etc.

There are some good docs out there, thus making your "splunk" application itself to handle API requests

0 Karma

pdevosceazure
Path Finder

I had seen this but could not find in in splunk any where in 6.5.
did not realise is as an add on. will try it out.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Can you please try below command in your script, added ().

IP=($(curl -s 'http://api.openweathermap.org/data/2.5/weather?q=london,uk≈pid=xxxxxxxxxxxxxxxxxxxxxxx'))

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...